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Taken before the Health Committee 


on Thursday 26 April 2007 


Members present: 


Mr Kevin Barron, in the Chair 


Charlotte Atkins 
Jim Dowd 
Sandra Gidley 


Mr Stewart Jackson 
Dr Doug Naysmith 
Dr Richard Taylor 


Witnesses: Mr Richard Granger, Director General of IT for the NHS and Mr Harry Cayton, National 
Director for Patients and the Public, Department of Health; and Dr Gillian Braunold, National Clinical Lead 


for GPs, Connecting for Health, gave evidence. 


QI Chairman: Good morning. Could I first 
apologise for the few minutes’ lateness of the 
Committee. It looks a bit thin around this side of the 
table but you are probably aware we have a Mental 
Health Bill in standing committee at the moment 
and members of this Committee have been heavily 
involved in it, in different forms, for the last eight 
years now. We have got some members up there who 
are currently doing standing committee work, but I 
suspect we will be joined at some stage this morning 
by one or two members. For the sake of the record, 
would you introduce yourselves and the positions 
you hold. Could I start with you, Dr Braunold? 

Dr Braunold: 1 am Gillian Braunold. I am a GP in 
Kilburn, and I hold the position of GP National 
Clinical Lead. 

Mr Granger: | am Richard Granger. I run national 
IT systems for the NHS in England. 

Mr Cayton: | am Harry Cayton, I was the Chair of 
the Care Record Development Board and I am 
Chair of the Ministerial Taskforce on the Summary 
Care Record. 


Q2 Chairman: Welcome back again. I think I said 
last time you were sat there you were better attended 
than some members of the Committee and it is 
absolutely the case this morning! I understand you 
want to make a short statement to us before we start 
this morning’s evidence session. 

Mr Granger: | want to cover three things: firstly, the 
general progress we are making; secondly, to give 
you a snapshot of the typical transaction volumes 
that benefit patients every day in the NHS in 
England today; and, thirdly, I want to finish with a 
comment on the general environment around the 
introduction of new technology into health care. 
When the Government announced its investment 
programme in IT in the NHS in England in 2002 
there was already a considerable quantity of 
computers in use in the NHS, and almost all of them 
were characterised by being nothing more than 
glorified electronic filing cabinets. If you wanted to 
move any information between buildings you 
typically had to move it using word of mouth or 
paper; there was very, very little movement of 
information between buildings. Of course patients 


generally do not just get cared for in one place. There 
are a number of people who would say that there 
have been enormous successes in the 1990s in 
investment in IT in the NHS. I would say, having 
come from a background of having worked in social 
security computerisation, the progress that had been 
made was lamentable—and yet at very significant 
cost of about a billion pounds a year at 2002. The 
revisionists are busy at work now trying to make out 
the progress that had been achieved before 2002 was 
extremely good and has somehow been retarded by 
the introduction of national systems; but the 
evidence does not substantiate that viewpoint. 
Where you have 33,000 or so GPs in nearly 9,000 
locations, and you have none of them able to move 
patient records electronically between sites and yet 
over three million patients a year change the GP they 
are registered with, I do not see how that mess could 
be described as a success; and yet some eminent GP 
IT advisers have described it as a success. One of the 
other things I found extremely quaint when I started 
delivering this programme was most of the people 
working in the delivery of clinical systems in the 
NHS have what would generally be considered to be 
serious conflicts of interest. They are the owners of 
software companies, have a financial interest in 
them, or advise them whilst also undertaking clinical 
practice. It has the benefit of them being closely 
associated with the solutions they deliver, and the 
disbenefits of them having certain conflicts they have 
to manage. We introduced a process as part of the 
procurement which was Civil Service standard stuff 
that we required people to declare these conflicts of 
interest, and we would not allow them to work on 
procurement activities if they had involvement with 
any of the potential bidders. That caused some 
distress for some of the so-called experts in this 
domain. It is what has been described by many as “a 
bit of an alligators’ playground”. In the last four 
years we have doubled the availability of network 
connectivity to the NHS. We now have 19,000 places 
connected up, so we have one of the biggest virtual 
private networks on the planet and people take that 
for granted. In some locations it does not work as 
quickly as the end users would like—usually because 
their equipment is badly configured when we go to 
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investigate. We are now computerising, to deliver 
prescriptions safely, 200 GP practices a week with 
the relevant software. We typically move 120,000 
prescriptions electronically now on any given day. 
About every ten seconds a patient gets a booking 
completed electronically, not at the target we would 
like it to be at but, nevertheless, a significant volume. 
I think you heard in your audiology hearing how 
Choose and Book is being used regularly now to 
enable accelerated patient flows, and is also 
introducing a greater degree of transparency about 
where the bottlenecks are in the system. We have 
about 50,000 people go onto our national 
demographic database every day and access two 
million patient records. That is something that did 
not exist three years ago; something that most major 
organisations and most government departments in 
the UK have had since the early 1990s—an online 
customer index so that you can send letters to the 
right place. In fact we see a reduction, as a 
consequence of that, from about three-quarters of a 
million patients having a letter sent to the wrong 
place down to probably around a couple of hundred 
thousand. The hospitals that are hooked up to this 
system say the number of letters returned, having 
been sent to the wrong place, has come down 
massively, which is a significant concern around 
confidentiality with a paper-based set of letters going 
out to patients, and inefficiency where an 
appointment gets sent out to them, for example, and 
they do not even get notification of it. We have got 
an e-mail service that has: a quarter of a million 
users; sends over a million messages a day; is 
encrypted; and over a third of those contain patient 
identifiable information. We have a system which 
has very efficiently paid GPs money under a “pay for 
quality mechanism” under their new contact. There 
were a few problems for a couple of days at the 
beginning of the new financial year as they 
stampeded into submitting their returns to get their 
money quickly. However, that system (apart from a 
couple of days) has worked very well since it was 
introduced. We have a major secondary uses 
database working as well. In closing I just want to 
reflect on how difficult it is to introduce new 
technology into health, because it is personal for all 
of us; we care about it; and a lot of people have 
anxieties. In the North-West we are about to 
introduce the Summary Care Record which will 
provide information about patients outside of the 
GP setting in which the best information is currently 
held. Around 0.2% of the public, where we have sent 
information leaflets to their homes addressed to 
them in person, have concerns about this. You might 
not think that is the case if you spend a lot of time in 
this part of London, but that is the kind of data that 
comes from other areas of the UK, and the North- 
West where we are bringing this system in. However, 
there are a lot of people very concerned. In 1834 The 
Times said, regarding a significant piece of medical 
technology, that, “it will never come into general use 
notwithstanding its value. It is extremely doubtful 
because its beneficial application requires much time 
and gives a good bit of trouble to both the patient 
and the practitioner; and because its hue and 


character are foreign and opposed to all our habits 
and associations. It is just not going to get used”. 
That was The Times writing about an invention from 
1816 which I do not think we generally consider to 
be adverse to medical practice now. They were 
writing about the stethoscope. I think the adoption 
of IT systems that move information between care 
settings and serve patients as they move around the 
NHS is in a similar position, of a great deal of 
anxiety because of the introduction of the new 
technology. People will look back on this in a couple 
of hundred years’ time and wonder what all the fuss 
was about. 


Q3 Chairman: Thank you for that. Many of the 
issues that you have highlighted, Mr Granger, we 
will obviously be pursuing in the course of this 
investigation, this being the first evidence session of 
the investigation. Could I welcome you and your 
colleagues as well. Going back 12 months or more 
now, most of the debate in the media (without the 
detailed things you have pointed out there) was 
people thought what was going to happen was that 
their patient record (and we assume by that, and I 
assume by that, it was one patient record) was going 
to go on the national spine and be accessible for 
people who wanted to know about my medical 
history. Actually we have got both a separate 
national and local electronic patient record now in 
front of us. Does this represent a failed compromise 
between the two different approaches? After all the 
talk about having one national record that was 
going to be all-singing and all-dancing for us, why 
have we ended up with two? Why is that? 

Mr Granger: That is not a change of direction; that 
is the details of plans which were documented in 
Spring 2002 in a document published by the NHS 
Information Authority, which I am sure one of your 
advisers is familiar with, which was called the 
NCRS, National Care Record Service. That 
document set out very clearly that there needed to be 
more widely accessible summary information and 
detailed local information; and the reasons for that 
relate to the ability of computer equipment to move 
large quantities of information around, and 
concerns about the need or absence of need for 
detailed information to be available outside of an 
individual care setting. We are trying to strike a 
balance between having nothing available 
everywhere, and everything available everywhere. 
Over the past three years my colleagues have 
undertaken a very extensive consultation exercise 
with clinicians and patients to strike what we think 
is the right balance there and to introduce that 
through a staged early adoption process. The delays 
we have had in doing that are a mixture of software 
complexity and an extended consultation period 
about how to do that. 


Q4 Chairman: Presumably the bulk of mine will be 
on the Detailed Care Record, and that will be what 
my GP and anybody in the South Yorkshire locality 
where I live most of the time will have. What added 
value will the national Summary Care Record add? 
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Mr Granger: | think it would have specific value to 
you as you shuttle up and down the country between 
South Yorkshire and London. For example, your 
key allergies and current medication will be 
available if you need treating down south during the 
week or, conversely, when you are up in Yorkshire 
at the weekend. 


Q5 Chairman: What would be the difference then? 
Mr Granger: At the moment that information is not 
available. 


Q6 Chairman: It is not available down here, yes, I 
accept that. What will be the difference in the record? 
That record can follow me from South Yorkshire to 
London and back again; one record can follow from 
South Yorkshire to London; but I am trying to tease 
out of you, what is the added value of having a 
national Summary Care Record in addition to the 
Detailed Care Record which will be about me and 
my potential needs? 

Mr Granger: Quite a lot of the record about you will 
not be coded in a manner that would be safe for 
other people to use. It will be meaningful to the 
people who collected it, and it may be voluminous. 
It may not be particularly relevant to the care that 
you need on a spontaneous basis when you are away 
from home. 

Dr Braunold: | think it may help to try and 
differentiate between the Summary Care Record and 
the Detailed Care Record, because they have 
different business functions and are intended to 
serve different purposes. The Summary Care Record 
is intended to be a first cut of information to help 
clinicians who have no access to any other records in 
the first instance who are unfamiliar with the patient, 
to help them to get started so they are not working 
in an absence of information. What we know is the 
first things that will go up will be the medications of 
the patients, the allergies and then it will be joined by 
significant medical history, but in a summarised 
way. We have left the content of the Summary Care 
Record of what will be uploaded in the first instance 
from the general practitioner to be customisable at a 
local level. The reason we have done that is because 
there is a different timescale in which the Detailed 
Care Record is being delivered around the country; 
and it is not coming in at the same time. There is the 
potential for the Summary Care Record to actually 
contain information that will serve local business 
requirements while they are waiting for the Detailed 
Care Record. If I take the example of a diabetic care 
pathway, one of our early adopter PCTs in the 
country is planning to use the Summary Care 
Record to help the people who are looking after 
patients with diabetes in the community, as well as 
in hospital and general practice; and they want to 
ensure that the content of the Summary Care Record 
will help to manage that care, and will have in it the 
recent results and the recent visits to the various 
members of the team. That will be enabled if that 
data is sent up from the general practitioner record. 
What is very important is that people in the locality 
where it is being used understand the use to which it 
is being put and the data set that is going in. My 


personal belief is that the amount of information in 
the Summary Care Record will start growing bigger 
and then go smaller again as the Detailed Care 
Records become the actual way that in the locality 
people start to share information; but, because this 
is a system in evolution, we have to start somewhere. 
We have started with the Summary Care Record in 
areas where there is not any other data-sharing quite 
often because those are the Primary Care Trusts that 
have said, “Yes, please, we want to be part of the 
early adopters process for the Summary Care 
Record”. They are very keen and eager to do some 
data-sharing in their areas. It enables us to test very 
slowly some of the concerns people have had around 
confidentiality and access controls et cetera, which I 
am sure we will be discussing, and test them slowly 
and incrementally, as well as what information was 
most helpful. 


Q7 Chairman: It has been put to us that the exact 
content of Summary Care Records is not yet known. 
Is this an evolving situation? 

Dr Braunold: There are some things that are 
absolute. I can very firmly take people through what 
we are doing with the Summary Care Record in its 
first iteration. The first thing that happens is a leaflet 
goes out to the population in the area; and then eight 
weeks later there is initiation of the repeat 
prescriptions and the acute prescriptions which are 
put up as well as the allergies and adverse reactions. 
That is followed by significant medical history, and 
we are starting with the core data set the GP has put 
into their Summary, and they are discussing that 
with their patients and asking them if they are 
comfortable with that data set going up in addition 
to the drugs and allergies. That is in discussion with 
the patient about what else should join the drugs and 
allergies. We have not been definitive about what 
should go in that part, as I said before, to feed the 
pathways; but also because there has not been 
guidance previously as to what is in an ideal 
Summary. Harry will be able to talk about the 
recommendations from the Ministerial Taskforce 
about advice as to what should be in an ideal 
Summary. 

Mr Cayton: Perhaps I could say a bit about this, and 
perhaps I could go back, first, and just think about 
some of the benefits as I see them from a patient 
perspective. You are right in a way to question this 
concept of people travelling around the country. Of 
course, people do travel around the country a great 
deal more than they did, but that is not really, I 
think, the most important reason why this is 
important. I spent a day recently shadowing an 
emergency care practitioner with the London 
Ambulance Service and we spent most of our time 
visiting frail, older people whose carers or relatives 
had rung up with that most common of conditions 
of frail, elderly people which is “had a funny turn”. 
“Had a funny turn” is not a very helpful diagnosis 
for a paramedic or an emergency care practitioner. 
Seeing what they have to do in practice, the 
complications of identifying which medicines a 
person is on, especially if that person is confused or 
not very well at all; trying to identify what conditions 


Ev4 The Electronic Patient Record: Evidence 


eae rea rann OPPS, Erne sree mENSr Ty PenenvenS Tern nn WEST =v npr ee mene 
26 April 2007 Mr Richard Granger, Mr Harry Cayton and Dr Gillian Braunold 


they have; the huge benefit to them of having access 
just to this very small data set initially of 
medications, allergies and adverse reactions; plus, of 
course, the administrative benefit of having a 
computerised system that they can use instead of 
very large amounts of filling-in of paper forms, with 
all the introduction of errors that often brings; I 
think there are some real benefits. One of the myths 
now is that we still have a profoundly long-term 
personal relationship with an individual GP. Many 
of us do up to a point, but GP practices no longer 
provide services in the evening and at weekends; so 
everyone who uses a GP service is inevitably using 
GPs who do not know them very well if they are 
inconveniently ill out of the hours in which GP 
offices are open. It is not just the situation around 
people who are travelling, or people who are 
unconscious in A&E; it is a situation for a vast 
swathe of frail, older people, and for every single one 
of us who might happen to be ill at an evening or 
weekend. In the Taskforce, to go back to the issue of 
what is initially in the Summary, we had a very 
extensive discussion. We had on the Taskforce 
representatives of the BMA, RCN, the College of 
Emergency Medicine, the Terrence Higgins Trust, 
nursing and so on; so we had a wide range of 
interests. We felt that the most appropriate way to 
go forward was cautiously and sensibly. We 
recognise that there are concerns; we recognise that 
there are doubts; and there seems to be quite a clear 
consensus, certainly around clinical people, that this 
small data set that Dr Braunold has described is a 
significantly useful data set in clinical terms and does 
not raise as many questions as might be raised by 
more sensitive information such as diagnoses or 
medical history. This is a step forward as we build a 
consensus around what works and what does not 
work. 


Q8 Chairman: That could be interpreted as being a 
compromise because the ideal is a national patient 
record, and what we have got now is that there are 
going to be two national patient records. It sounds 
to me as if this is as far as you can get. Was this a 
political compromise in terms of what you wanted in 
the first place and what we have at this stage? 

Mr Cayton: I do not know that you can use the word 
“political”. 


Q9 Chairman: It is a compromise then? 

Mr Cayton: You might say it is a “professional 
agreement” around what is acceptable to conflicting 
interests within the system. Interestingly, as the 
patient or independent person on this, many of the 
conflicts are between clinicians; they are not between 
clinicians and patients on these issues; they are 
actually between different groups of clinicians who 
have different conceptions of their role within the 
Health Service; different conceptions of the balance 
of power within the Health Service; and who are 
trying to protect the interests of certain clinical 
groups, sometimes I have to say, under the disguise 
of protecting the interests of patients. 


Chairman: I have personal experience of the same 
group of medical people in my constituency who 
have different attitudes towards some of these 
matters. 


Q10 Dr Taylor: I want to move on to the Detailed 
Care Record. I can see how feasible the Summary 
Care Record is; I just cannot see how feasible the 
Detailed Care Record is. We gather it is going to be 
made up of different records from different hospital 
departments, from the GPs. The only information 
we have got in the Department of Health’s 
submission about Detailed Care Records is under 
paragraph 29 where it says: “The Detailed Care 
Record component of the NHS CRS will support 
the care process and will typically contain: the name; 
address; date of birth; NHS number; past and 
current health conditions; allergies; assessment ef 
cetera; care plans et cetera; treatments, including 
operations and medication; care reviews; and 
discharge information”. I am very, very concerned 
about the amount of information that is in hospital 
notes, and please do not think I am denigrating GPs, 
because obviously they have got the shorthand type 
notes worked out to a high degree, and it is going to 
be relatively easy to computerise GP notes. It is 
going to be extremely difficult to computerise 
hospital notes, which are going to be needed in the 
Detailed Care Records. I would like some ideas, 
some guidance on how you are going to approach 
this and make this even possible. I have got lots of 
specific points to pick up. 

Mr Granger: If 1 could start on this and if Gillian 
could follow. I think there are two problems. The 
first is that the computer systems that have existed 
before this programme have typically only served 
doctors in one care setting. It has either been a 
hospital system or a GP system. The market was 
very firmly orientated in that manner. We have the 
challenge of getting suppliers of GP systems, and 
give you for example EMIS and TPP as two 
suppliers based in Leeds, both of whom are pushing 
upwards into community and ambulatory care 
settings with increasingly rich products. At the same 
time as you see the supplier for the South and 
London in the acute sector, Cerner, who run the 
systems that support a third of the hospitals in the 
US, you see them pushing downwards into what 
they would term “physician offices”, into GP 
practices. That was a problem that existed before we 
started this programme, and it is still work in 
progress. The second problem is that, whilst GPs use 
Read codes and localised variations of them (and the 
variations are one of the greatest problems to 
information liquidity between practices), in 
secondary care a lot of the information is only coded 
up after the actual interaction between the clinician 
and patient. Our challenge is to introduce systems 
where people are coding information at the point of 
care; and some of the codification of those systems 
will be better supported by something we have been 
working on for some time, which is a proper 
international standards body called SNOMED CT, 
which is a much more detailed structured 
nomenclature to support secondary care, because 
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obviously Read codes are inadequate in that setting. 
We have had to take the lead in launching an 
international body to do that and wresting that from 
the College of American Pathologists into an 
international body, and that will be announced later 
today. It is going to be a long and difficult process to 
get the complexities of secondary care to code 
information in a way that it can be used outside of 
the location in which it was originally created. We 
are going through some of those difficulties at the 
moment in the south of England with the 
implementation of the Cerner system, which is 
requiring much more data to be collected at the 
point of care, rather than it being coded up 
subsequently; which is introducing problems of 
efficiency in the way the NHS is currently organised 
in terms of rapid clerking of patients, followed by 
retrospective tidying up of records and production 
of billing information and so on. It is a challenge at 
the moment but we are working through that. 

Dr Braunold: | totally understand the question, and 
I suppose it is important to have a goal. I will try and 
describe the picture very quickly and then look at the 
steps we need to go through to get there. As a GP I 
get something like 125 letters a week from my 
colleagues in secondary care about my patients and 
those are structured usually most about the history 
of that patient—that has always been there; and 
occasionally there may be some recent results and 
the medication that has been used; and then there 
may occasionally be a sentence asking me to do 
something. I have to read that letter very carefully in 
case there is an action and I need to file it in my 
records. In order for me to do that, that has come 
from a hospital usually dictated by a consultant such 
as yourself, and it is then typed up by the secretary 
onto a computer; it is then printed out; and it is then 
sent by snail mail to me; and I then have somebody 
who receives it, scans it, then puts it into my 
computer and somebody codes it back into the 
computer and checks there are no results or anything 
I need to do; and then, finally, I check for any 
actions. For me it is not only a saving of all the 
scanning and the obvious things that an electronic 
message could do, but I want to save some of the 
coding issues so that instead of me receiving stuff for 
information, which we should share in a Detailed 
Care Record, that we would change the way we 
work; that we would only need to send each other 
actions, instead of sending each other information 
that we share on a Detailed Care Record. That for 
me is the Holy Grail of what we are about. It is about 
really changing the effectiveness and the efficiency of 
how we work. To get there is not going to be quick. 
It has taken general practitioners a decade or more 
to learn how to code carefully and accurately. We 
have worked through a data quality exercise that we 
are doing at the moment, on actually saying only 
GPs who pass the data quality accreditation can 
submit to the spine, because we want data that is fit 
for sharing. There is an enormous amount of work 
to do with secondary care. I understand your 
concerns. One of the things which my colleagues as 
the National Clinical Leads for hospital doctors are 
very keen to do is to really look at incremental ways 


of delivery of product. This is not a shiny spaceship 
going to land on secondary care where suddenly 
everybody has got to do this. I went to visit the 
Homerton Hospital where Simon Eccles one of my 
colleagues is based and I said, “I’ve heard the 
Homerton is great and it’s running this great 
system”. I came from general practice and I am used 
to flying with my machine and, I have to say, froma 
general practitioner’s perspective I was _ very 
disappointed. The reason I was disappointed is 
because I am used to a very functionally rich system. 
What gets secondary care colleagues excited is a 
particular product delivery of particular issues. They 
have got Order Comms (Order Communications). 
Order Comms means if they send off 15 blood results 
they can see at a glance if 12 of them have come back, 
click on it and see them. They have got bar coding so 
they know where the results are on the system and 
they can track them, and that is great. It is the 
equivalent for me of where we were when we got 
repeat prescribing. We knew what to do with 
prescriptions and waves of GPs started to use 
computers because there was a business benefit to 
them. I see the secondary care delivery of products 
as Cerner and Lorenzo and all the others going 
through their various iterations delivering more and 
more functionality, year by year. People start saying, 
“What’s coming next? That was quite good”. The 
challenge for us really is to make sure that we do not 
make that challenge too painful; because you cannot 
ever get gain without pain. You cannot take on a 
new laptop without having to learn something. It is 
always painful gaining new functionality. We have 
to make sure that we do not challenge the NHS too 
greatly in the delivery of these extra functionalities. 
I hope that explains what the Detailed Care Record 
is for, because I really think it is worth having and it 
is a challenge worth taking up; but it is not going to 
be speedy. 


Q11 Dr Taylor: I am not saying it is not worth 
having, I am just wondering if it is a possible dream 
in the long term. I can quite see how it is easy to put 
on X-rays; it is easy to put on path results; it is easy 
to put codes and prescriptions. There is an awful lot 
of importance in narrative text in hospital notes. 
How are you going to cope with that? I am thinking 
particularly that the complaints we get as MPs 
largely are associated with lack of communication 
between staff and patients. The basic defence you 
have got as a doctor is that you have recorded what 
you have said to the patient or the family. How is 
that sort of narrative text going to be in the Detailed 
Care Record; or are we still going to have a paper 
record in the background? The idea is to get rid of 
paper altogether. 

Mr Granger: One of the feedbacks we had from the 
new system we put in in Winchester was that the 
nurses were delighted with the noting functionality. 
We are looking at trying to increase the quantity of 
information which is codified so it can be used safely 
in multiple locations, even within an individual 
institution; and we are providing a facility which 
allows people to put the notes in free text format 
onto a computer system, so that they carry forward 
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as well. I recognise a lot of people like to use free text 
because it can be easier for them than codifying 
things but it has a systemic inefficiency for the NHS 
unless they are the only person caring for that 
patient. 


Q12 Dr Taylor: But you cannot codify a unique 
conversation between a doctor and a relative? 

Mr Granger: No, but one of the things we generally 
do not codify, for example, is causation. We will 
codify that somebody has broken various bones but 
we will not codify the fact that is because they fell 
over; so we discharge them from hospital and they 
trip on the carpet and come back. What we need to 
get to is the root cause of lots of people falling over 
as they get older and their housing conditions. You 
start to collect coded information about a fall which 
does exist in SNOMED; you start to get some very 
useful information about the root cause of the 
admission; whereas just typing that in free text, 
“Had conversation with patient; she told me she fell 
over again”, is not very helpful. 


Q13 Dr Taylor: You are not taking my point. What 
I am really bothered about is the conversation 
between staff and a family, explaining what is going 
on with the patient. 

Dr Braunold: | think that is absolutely right. For me 
that still has to be recorded. There is no reason why 
it cannot be recorded on the computer in free text 
format. 


Q14 Dr Taylor: How is that actually done? The 
doctor writes down in the notes in longhand? 

Dr Braunoid: That will be subject to the local 
business processes in that Trust. It takes a while for 
people to move forward. When we went, for 
instance, to the States (because I went to have a look 
at how it was working there) quite often the 
consultants were dictating, and other people were 
entering the data; and they may have written in long 
form and somebody would then take it and put in 
the computer; whereas in other places people are 
putting it directly into the computer. What some of 
the software is able to do, however, is as you type in 
it is able to suggest codes for part of the text you are 
typing in so that you are not losing the opportunity 
to have the coding happen simultaneously. It will 
offer you a code for part of that. Some of the pain we 
have gone through in general practice is that, 
frankly, if I look at some of my colleagues’ records 
the most frequently used code in general practices is 
“had a chat to patient”, and then everything is 
underneath. The move to a richer coding set came 
with the input of the quality and outcome 
framework, as people started to realise if they did 
not code peak flow measurement properly as a code, 
rather than somewhere in that text as they had done 
previously, they were not going to get acknowledged 
for the work they were doing in looking after people 
with asthma properly. It is around getting people to 
understand payment by results and your actual peer 
audit are things that will encourage people to code 
properly; but that should not take away the text that 
we have to still write. 


Q15 Dr Taylor: Has there been any attempt to get 
agreement from hospital doctors on what goes in the 
Detailed Care Record? 

Mr Granger: There has been a process that has been 
going on since the early 1990s around that. I am sure 
you are more familiar with that than I am in fact. 
The specifications we have produced software 
against have their most recent origin in work that 
was done between 1998 and 2002—electronic record 
pilots; and in communities around England that 
were in the process of buying local systems which 
were generally unaffordable when they got through 
their procurement process in the South-West, the 
West Midlands, for example, the Shires 
procurement and Blackbird procurement. Those 
were specifications that had been produced by local 
clinicians, lots of hospital doctor input; and that is 
then iterated and refined continuously around the 
country as we take early versions of systems and 
refine them. It is an uncomfortable process because 
the requirement changes with time, as people 
become familiar with systems; so to start with people 
may want lots of free text input and they may want 
to do that via a Dictaphone or manuscript, then they 
want to move to typing some of it. One of the 
challenges that exists in the hospital sector is that it 
is only now, in fact a couple of months ago, that the 
first computer that might actually be really useful for 
a doctor on a ward round was launched. It is a device 
which has been developed between the NHS and 
Intel. Before that you had, at best, a laptop, which is 
a very nice repository for clinically-acquired 
infections; or you had a computer on wheels, known 
as a “cow” generally, dragged around a ward with 
batteries or wires hanging out the back of it— 
completely useless for somebody moving through a 
hospital on a ward round. The hardware is only now 
catching up with the way that hospital doctors work. 
We have had the same challenge with rolling out 
PACS (Picture Archiving and Communications 
Systems). It is very easy to put a light box in lots of 
places; they are not very expensive; you move to 
putting in computers and you need very high 
resolution screens that are £10,000-£15,000; they 
need a power supply; they are heavy; they need 
hanging on walls in theatres; people who might have 
had screens on three sides with their light boxes and 
now you have got a problem putting the IT in with 
the same information availability. 


Q16 Dr Taylor: So when is this marvellous 
equipment going to be available? Is it something you 
speak into and it automatically gets it on? 

Mr Granger: We have that running already. Voice 
recognition is being used. 


Q17 Dr Taylor: Is it now reliable? 

Mr Granger: It is getting reliable. It is being used in 
several hospitals for reporting in picture archiving. 
These are emerging technologies. They have been 
around for a long time but they have generally been 
designed to work in office settings. Most computers 
that work in hospitals at the moment are office 
equipment; they are not hospital equipment. Their 
portability; their cleanability; the ability to make 
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them hygienic; has been very poor. We have been 
developing the specifications for washable 
keyboards, wipeable computers that do not have lots 
of ports that are uncleanable and so on. The first 
batch of that equipment was trialled in Salford over 
the past few months and will come onto the market 
over the next few months. 


Q18 Dr Taylor: Will that allow, for example, the 
detail of the houseman’s history, the detail of the 
houseman’s examination to be recorded on the 
system? 

Mr Granger: Yes. Those tablets that are the size of a 
notebook, they will do handwriting recognition, 
voice recording or allow typing either by touching or 
tapping; and they will allow images to be displayed 
with a reasonable degree of resolution as well. 


Q19 Dr Taylor: Is this going to delay the system 
further? 

Mr Granger: No, but this is something we have to 
do. From 2002 in the strategy to introduce these 
systems we found a number of barriers. One barrier 
was there was not nationally available broadband. 
We have had _ Telco (Telecommunications) 
companies digging roads up and putting cable down 
in the South-West, for example. Another barrier is 
the computer equipment that has traditionally been 
used in clinical settings, certainly in acute settings, is 
not optimal, and we have had to work with industry 
to develop that. This is the NHS doing things in a 
world-leading setting and it has been difficult and it 
is time-consuming. 


Q20 Dr Taylor: Is the main reason for getting the 
Summary Care Record out first really because it is 
much easier and practical? 

Mr Granger: | think developing a couple of 
thousand work year software products to a schedule 
we stood up 18 months ago, that we hit the dates on, 
has not been easy. I think it delivers significant value 
out of our investment in a security framework, a 
central demographic database, a network, and now 
102 different end-user systems that are compatible 
with that central infrastructure. It was always part of 
the plan. The sequencing of this programme that was 
stood up in 2002 and what we have now is different. 
We did not have picture archiving in 2002 at all and 
we will complete its roll-out during the current 
financial year. 


Q21 Dr Taylor: Do you think you really can answer 
a GP who has written to us saying the Detailed Care 
Record can never provide the level of detailed data 
sharing which would be necessary for shared care? 

Dr Braunold: | find that one difficult, because shared 
care we do at the moment as best we can; so I do not 
really know what standard that GP is talking about. 
Improved information will improve our care. I know 
how often I would like to have information, or it 
delays optimum treatment of a patient because I am 
waiting for a letter to come or information to come 
and I have to bring the patient back. Availability of 


information at the touch of a button will help 
improve care for all of those GPs as well as my 
hospital colleagues, so I find that one difficult. 


Q22 Dr Taylor: I suspect he is worried about loss of 
the paper system which, if you have got time to use 
it, does give you everything you need. 

Dr Braunold: { was talking to what I would call a 
“Luddite GP” the other day who said he mourns the 
loss of discharge letters—because they are getting 
electronic discharge letters, that I would give my eye 
or teeth for, in his area of Gloucestershire—because 
he is used to highlighting on it and getting people to 
code it; and now because he is getting it 
electronically quicker than waiting three weeks for a 
letter, he is getting it in two or three minutes, he has 
actually lost the business process. That is the 
challenge for us about learning to work differently 
when we have got better conditions. 


Q23 Dr Taylor: Another concern raised to us is from 
groups who represent patients with long-term 
complicated conditions, because they are longing for 
the Detailed Care Record to be out quickly. What 
can we say to them? 

Dr Braunold: That is exactly what we are doing in 
one of my areas about the Summary Care Records. 
Because it is going to take a while, one of the real, 
real benefits that I have not discussed about the 
Summary Care Record is the patient’s record that 
they see from Heathspace; and that is something that 
can be put in (all of the information that will help 
with those pathways) straight away to support those 
patients and help them wherever they go, because we 
can put that information in. The patient will have 
access through the internet, through their own 
access controls, and they can share it where they 
wish under their own control. 


Q24 Dr Taylor: Why should we not be slowly 
developing the Summary Care Record to become a 
Detailed Care Record? 

Dr Braunold: Because we need to have quality 
information that is far more than a_ general 
practitioner-originated record. We need to start 
having coded information from wider places than 
GPs. GPs only look after patients 36 hours a week. 
We need to join people up. Frankly, I know the 
frustration of my colleagues in nursing who cannot 
access my records. 


Q25 Dr Taylor: You are implying there is going to be 
no hospital information on the Summary Care 
Record? 

Dr Braunold: There will be, but that is joining in 
2008 onwards. That will start to be messages around 
discharge, and messages around the outpatient 
letters; but it will not be the richness of what you 
were describing—a conversation with a patient you 
put in your internal system which you would not 
necessarily tell me about. I do not want to know 
every sodium and potassium in the intensive care 
unit; it is totally inappropriate to be available to me 
routinely. 
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Q26 Dr Taylor: It has got to be recorded somewhere? 
Dr Braunold: \t must be in the hospital system. 

Mr Cayton: Richard, you are putting your finger 
precisely on the point that the Chairman raised 
earlier, that there are conflicting interests and 
conflicting views about the best way forward. What 
we are increasingly trying to create is a system that 
has some local flexibilities, that has a lot of choices 
for patients themselves to make about what is shared 
and what is not shared. As we described earlier, as 
the Summary Care Record is established, if people 
want to use it, and if patients agree with their GPs to 
upload more data to it, then it will become richer and 
more useful. You are quite right, my experience 
working with many of the organisations 
representing people with long-term conditions, they 
feel very strongly that they want to have a fairly rich 
shared record and they want it as soon as it can be 
reasonably provided; but we have many interests to 
balance in trying to achieve this. 


Q27 Dr Taylor: Are the psychiatrists on board? 

Mr Granger: | think with 30 mental health patient 
administration systems the people who have 
received those probably are. There are specific issues 
with particular patient groups around concerns 
about the propagation of information, sexual health 
and other groups. Gillian might talk about some 
consultation work we have done there. I want to 
reassure you on one thing around Detailed Records. 
We have delivered 13 community hospital patient 
administration systems; 171 community care PASs; 
30 mental health PASs. These are systems that have 
introduced IT for the first time to quite a lot of 
frontline NHS workers that are shared Detailed 
Care Records working across communities. You can 
go to large parts of the country now, including in this 
city, and see people who were previously using paper 
notes, having to go back to offices and having to 
send letters to colleagues within multidisciplinary 
teams. My wife has worked in a community setting 
in the NHS and 30lbs of paper was a typical load she 
was carrying around as a speech and language 
therapist; and the only way she could propagate 
information across the community was by posting 
stuff; she did not have any other systems. A lot of 
people are getting systems now that do support that 
detailed care; but we come back to the problem of 
getting the warring software suppliers to get their 
software to work across multiple settings. We have 
achieved quite a lot of information flow thus far. We 
are running about 200 million interactions now 
across the spine, and I think you are going to hear 
from Patrick O’Connell of BT later who runs that 
service and you can talk in more detail about that. 
This is a difficult nut to crack because some people 
would like all information to be available 
everywhere; and then at the other end of the 
spectrum there are the privacy fascists who would 
like to dictate that nobody has any information 
available anywhere. We have been trying to forge a 
path between those extremities. 


Q28 Charlotte Atkins: Why was it considered 


necessary to move patient data to national and 
regional databases when developing the new records 


systems? Won’t central databases be more 
vulnerable to security breaches? 
Mr Granger: 1 think there are different 


vulnerabilities. All information is vulnerable. We 
had to deal a couple of weeks ago with an incident of 
some PCT records, paper records, being left in filing 
cabinets that were trundled off to a scrap yard—a 
not uncommon occurrence, sadly, with paper 
records, that they go astray. Computers with records 
on them that are accessible get stolen from NHS 
premises; and people maliciously try to break into 
large central databases. No computers are totally 
secure; and paper records are not secure either. 
Where you have a situation where information is 
being freely available on paper within a hospital 
setting, it has the vulnerability of being browsed very 
easily by the very people living in the community 
that the patients come from. The same can be true in 
a GP practice. Where you have a central or regional 
database, you have the vulnerability of systemic 
examination of information either by people from 
within that community or strangers. We are very 
alive to that. There are significant sociological 
challenges in the busy world of health care around 
the balance between the ready accessibility of 
information to enable people to do a job quickly and 
adequate security. We decided in 2003 to adopt the 
gold standard, as it existed at the time, of Cabinet 
Office information security, a standard called e-GIF 
(e-Government Interoperability Framework) Level 
3, which means we have issued 350,000 smart cards 
to frontline NHS staff and put them through a 
screening process which is not dissimilar to that 
which is necessary to obtain a passport, and they 
have had to be vouched for by senior colleagues in 
order to gain access to information. That has been a 
laborious process that has been effected through 
4,000 registration points. We are the only piece of 
civil infrastructure in this country that has done that. 
We have had a couple of instances now, and one was 
through the ignorance of a temporary member of 
staff whose contract was terminated as a 
consequence of it, and the other was a deliberate 
decision in a busy A&E department. We have had a 
couple of instances of local variation and breach of 
the standards we have stood up: one smart card per 
person; that card must only be used by that person 
and so on. The technologies to enable us to move to 
something slicker than the use of smart cards are 
immature. We looked at using facial pattern 
recognition, retinal recognition and so. on. 
Fingerprinting is not great. Although it exists as a 
mature technology it is not great in an environment 
where people wear rubber gloves. There are quite a 
lot of form factors around assuring rapid access to 
information and it being secure in a clinical setting. 
There are risks to central databases; there are risks 
to local databases; there are risks to paper. One of 
my great sadnesses about the last four and a half 
years is that we did not have the opportunity to 
spend two or three years doing benchmarking and 
cogitation because the benefits of getting systems in 
have outweighed that; but if we had we could have 
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collected vast quantities of information about 
confidentiality breaches caused by paper; because 
that has been the status quo, and the risks to patients 
of paper going missing as well. The same is true of 
other physical media, like X-ray films. Yes, there 
could be a risk of having a repository with over 200 
million X-ray images on it, and other digital images, 
but there is certainly a risk if you go to the average 
district hospital and they have to re-shoot 20,000- 
30,000 studies a year because the X-rays went 
missing. 


Q29 Charlotte Atkins: Given what has just happened 
with prospective junior doctors, what confidence do 
you think the public and patients will have in a 
computer-based system of this nature? Clearly, there 
were problems with paperwork; I know there were 
problems with smart cards left lying about and this 
sort of thing; but, given that very personal, 
confidential details of prospective junior doctors 
have gone public, how do you feel that this is gong 
to affect the public’s confidence in being able to 
develop a system which is secure? 

Mr Granger: With regard to today’s news, I am both 
pleased and sorry that I do not run that system. Iam 
pleased I do not run it right now because it has gone 
wrong; and I am sorry I did not run it because it may 
not have gone wrong if I had. The only responsibility 
I will take in that space is that I unfortunately put the 
network connections in on time. Of course had I 
failed to do that nobody would have been able to 
access it, and it would have been my fault. We have 
had a great deal of assurance and scrutiny about 
what we are doing in terms of systems security. No 
system is ever going to be totally secure, but a 
remarkable number of the general public do entrust 
information through electronic channels with far 
lower levels of security than we offer, whether it is to 
their bank, when they go shopping, or they accept it 
as a matter of course if they travel by airplane, for 
example. I think that what we are talking about is a 
level of concern which is legitimate, and the balance 
of the benefits of the new system. I think the benefits 
far outweigh the disbenefits. We have a number of 
people whipping up anxiety about the disbenefits. 
They are rather similar to people who have a fear of 
flying: are we going to ground all airplanes globally 
because some people are scared of flying? 


Q30 Charlotte Atkins: You have just given 
assurances to people that because you are personally 
in control of this nothing is going to go wrong. 

Mr Granger: No, I did not say that. I actually said all 
computer systems are vulnerable, and no computer 
system can be completely secure. 


Q31 Charlotte Atkins: You implied that if you had 
been running the system that was dealing with 
prospective junior doctors that there would not bea 
problem. You have the opportunity now to be able 
to give assurances that you will put in place systems 
which make sure that will not happen, except in the 
most extreme circumstances. What would you say to 
a nervous patient who is going to give permission for 
their personal details, very sensitive to themselves, 


going on this system? Given what was happened 
with the junior doctors, why should they be 
confident that the system will work for them? 

Mr Granger: | would say three things on that. 
Firstly, I think we have a high quality team deployed 
and worried about this issue. It is not something we 
take casually; it is something we take very seriously. 
I cannot give you a cast iron guarantee that things 
will never go wrong because that would be 
misleading you. We take the matter very seriously. 
Our suppliers have a track record of working in this 
space. They all do work for security services, for 
example; and indeed one of them has a team that 
largely emanates from a security service running 
their NHS work now. Secondly, we are introducing 
this functionality incrementally; so it is not a big 
bang and we are taking things step-by-step, which is 
a good way of mitigating risk and examining what is 
going on before proceeding to the next stage. 
Thirdly, I would say one of the most worrying 
aspects of the NHS at, say, 2002, and surveys were 
done in 2002-2003, is that most people that we serve 
incorrectly believe that the information from earlier 
in their care is available at the next stage. We have 
not until recently started to fulfil that understanding 
that the public have about how the NHS already 
operates. 

Dr Braunold: Can I come in with a couple of points 
from my perception? If we were to say, “Okay, let us 
scrap it. It is too hard, it is too difficult, we should 
not do this, the risks are too great”, my own 
perception is that the technologies exist for 
information sharing and what people would do 
(because I see it already) is start sharing information 
inappropriately. They would use ordinary email 
systems, they would send people information that is 
confidential through insecure ways, and, for me, 
what the National Programme for IT is really about 
is spending enormous resources but important 
resources on getting the information governance 
right so that we share information appropriately. 
For me as a clinician, the challenge in the last decade 
was clinical governance, and when it first came in as 
a phrase I think many clinicians did not understand 
what clinical governance was: it was a buzz word; 
they did not know what it meant. Ten years later, 
people really understand what clinical governance 
is, what it means to them as a clinician, and they 
want to raise the standards of clinical care that they 
deliver to patients. The challenge for the next decade 
is information governance. I think if I said that to the 
average clinician in my PCT, they would not really 
understand their responsibilities around 
information governance. That is where we are at 
now. In ten years’ time, I believe that people will 
really understand what their responsibilities are 
about protecting patients’ data, sharing 
appropriately information and what _ their 
responsibilities are about its accuracy and security. I 
think that that is why we are doing things very 
slowly, and incrementally. When we looked at the 
Summary Care Record we could have said to all 152 
PCTs, “Just do it”, but from where I am sitting we 
have to do things very slowly and incrementally and 
evaluate what we are doing. We have got an 
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independent evaluation that is being commissioned 
(it was announced yesterday) with the University 
College of London that will be evaluating all of these 
access controls that we are describing that are not 
present in what happened with the junior doctors 
thing that was declared this morning. These access 
controls have to be tested to make sure they work as 
they have been commissioned and tested on a small 
group of patients before it is rolled out wider. I hope 
that gives some reassurance. 


Q32 Charlotte Atkins: The British Computer Society 
suggested that you should have a distributed 
database with information stored locally but 
accessible in a secure way to clinicians through a 
web-based search engine. Would that not be a more 
secure way of doing it and eliminate some of the 
concerns which patients might have? 

Mr Granger: Perhaps we could let you have a note 
on the number of computers that have been stolen 
from within the NHS, as best we can calculate it. It 
is interesting. I do not know whether there are 
hardware manufactures advising them as well. The 
costs of doing that are quite significant. You have a 
complex technical solution. I find it perplexing when 
we have had 20 years of systems that have been 
essentially based around a central mainframe or, 
now, a set of boxes concatenated together with 
relatively little information getting stored in the end- 
user domain and it passing securely over networks. 
We did not want to, frankly, experiment with the 
very, very large distributed network. None of the 
leading suppliers of solutions in this space who are 
willing to bid take financial and completion risk 
around the delivery came up with that architecture, 
but they are in the business of actually delivering 
things, making it work and then getting paid; they 
are not in the business of producing reports. 

Mr Cayton: Could I add, again, perhaps from the 
perspective of the Care Record Development Board, 
because the point that you raise, of course, is exactly 
right. There is nothing more designed to raise 
people’s anxiety than the kind of story that I, like 
everybody else, heard on the Today programme or 
read in the newspapers this morning. As I was 
coming here it was a pretty heart-sink kind of 
moment to hear exactly that story coming out. What 
we have certainly always argued is that public trust 
in this system is fundamental to its success, as, 
indeed, is clinical trust, and I do not think any of us 
would be, as Richard has already said, remotely 
sanguine about the fact that we have cracked this, 
although I have to say that we have continued to 
deliver and to solve quite difficult debates and 
problems against a pretty relentless barrage from 
those who do not think this is the right way to go. 
What I would want to say about the confidentiality 
and security issues is, first of all, that we are 
continuing, as Gillian said, to improve our control 
and management of those in the NHS through 
improved support for Caldicott Guardians, the 
development of information governance rules and 
structures. The Government has already announced 
that it is establishing a National Information 
Governance Board, which is being supported by the 


BMA and many others, but really the problems 
about information governance are about sociology 
and not about technology; they are about human 
error, as I suspect the issue with the junior doctors 
database was, and they are about human wickedness 
and about people actually deliberately doing bad 
things with data—stealing it, and so on—but there 
are over 45 laws that apply to data management, 
confidentiality and security, there are seven codes of 
conduct, there are 11 sets of standards and 
guidelines, and those apply now and they will apply 
in just the same way with an electronic system, and 
we have been supporting the Information 
Commissioner in his bid to increase the penalties for 
people who maliciously steal and misuse data. 


Q33 Charlotte Atkins: Have any other countries 
developed a similar system—cither the one that you 
are suggesting or, in fact, a local distributed 
database as is suggested by the Computer Society? 
Mr Granger: We have the misfortune of being first 
out of the gate with quite a lot of what we are doing, 
and different countries have different challenges, but 
if you look at provision in large providers in the US, 
for example, Kaiser Permanente or the Veterans 
Administration, you find large central databases. 


Q34 Charlotte Atkins: We are intending to look at 
those, yes. 

Mr Granger: If you look at what has been done in 
Alberta, you find a large central database but, in 
fact, set off with a fantasy of consent for the minutiae 
of information governance at each patient clinician 
interaction, and they gave up after about six months 
because, clearly, the doctors had better things to do 
with their time. If you look at the proposals that are 
being worked through by _ regional health 
information organisations in the US at the moment, 
they are about delivering HL7 standards based 
infrastructure to move information between health 
organisations, which is exactly what the Spine that 
we now have working in England does. Some of the 
smaller European countries have spent 15 to 20 years 
developing county-based distributed systems at very 
significant cost, and they have had a lot more time. 
They have different solutions. A number of 
jurisdictions are currently out to tender to buy 
something that looks remarkably similar to that 
which we now have large parts of working in this 
country. So it is a mixed picture. The structure of the 
NHS is unusual compared to other jurisdictions. 
The arrangements we increasingly have with private 
sector providers of NHS care and the accreditation 
process we have around them being enabled to 
display booking information in GP practices, 
bookings to be made and to interface with our 
demographic service and security arrangements, and 
so on, are models about which we have had visitors 
from Canada and Australia frequently because they 
see that as a template for their own arrangements. 
Dr Braunold: The other area is that I have done a 
little bit of journeying inside the UK and been to 
look at where there are some large databases already 
that are giving benefits. In Scotland, for instance, 
there are two million patient records of drugs and 
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allergies that are helping out of hours care in 
Scotland that are on a single database; in Hampshire 
and the Isle of Wight there is a repository which 
holds all of the GP records—the coded section, not 
the text—and discharge information from the 
hospitals, and results, and X-rays and letters. There 
is an enormous amount of information § in 
Hampshire, for instance, on a very large repository. 
They have all gone for putting information into a big 
pot, if you like, that various places access rather than 
distributed choice in those areas. 

Mr Cayton: A rather extreme example, but in the 
Veterans Administration in the States, when they 
had the terrible floods in New Orleans the Veterans 
did not lose a single patient record because they were 
held on a secure database in Texas. Their patients 
were able to go to veteran hospitals in different parts 
of America and immediately receive their own 
patient record, whereas many other hospitals had 
their entire record systems wiped out. I hope our 
system will never need to meet that kind of problem. 
Mr Granger: | will give you an example of where we 
have had that kind of problem: the Buncefield oil 
depot fire wiped out system availability for a number 
of NHS institutions that had systems run by a 
company called Northgate for a good couple of 
weeks, and I understand there may have been data 
loss as well. We had some difficulties, which I think 
were growing pains, last year with one of our 
suppliers who you have appearing as a witness, CSC, 
where we had some system failures. We did not lose 
any data and we have, since then, doubled the level 
of resilience. We do not just have one back-up site 
and tapes, we have now three back-up sites. There 
are systemic risks around central systems and there 
are systemic risks around local systems, and one of 
things, I think, we need to be mindful of in this 
country is the mobility of the population. In London 
one in four patients may change PCT in a year, and 
having information locked into local systems does 
not necessarily serve them well. Across the whole 
country we are looking at increasing mobility of 
patients as extended choice comes in. We need to be 
able to move coded information around the country; 
so I think an architecture that allows an extreme 
level of heterogeneity of solution and tries to make 
that standards based. We approached the BCS and 
asked them if they would like to assist in the 
accreditation process. It is a question that we 
continue to work through with them, but there is a 
balance to strike between having everything that is 
one (as it has incorrectly been described) monolithic 
system, having a small number of systems and 
having massive variability and standards based 
interaction, because the standards are not 
sufficiently mature at the moment. 


Q35 Charlotte Atkins: You also decided, indeed 
your evidence says, not to go for any sort of 
wholesale replacement of existing IT systems. Is not 
that a change in direction from your original plan? 
Mr Granger: There is a mixture. I will be clear with 
you. We found it very, very difficult to replace 
existing systems. Brownfield site implementations 
are incredibly difficult. We did three of them last 


weekend—Ipswich, Northampton and Surrey and 
Sussex hospitals. You might have half a million 
records, 10 to 20% of which are duplicates or 
corrupted, that have to be cleaned up by staff in the 
hospital; you might have 30 to 40 feeder systems, 
some of which require on-line interfaces to the 
central system; one to 3,000 users operate over one 
to half a dozen sites in each trust; you have to do the 
implementation, switch from one system to the 
other, over a weekend. It is a big heavy-lifting 
systems engineering job. It is like replacing the core 
systems in a small government department or small 
corporation—perhaps a 300 to 500 million pound 
turnover organisation—in a weekend. They are 
really difficult to do, which is why we have had 
significantly more success putting in systems where 
things did not exist previously or overlaying new 
functionality. Yes, it is an evolution of what we are 
doing based on the engineering reality we have 
encountered. Where we started from in Spring 2002 
was a Strategy. It was called a strategy and that is 
what it was. It was not an engineering plan from the 
ground up. We found data system conversion to be 
challenging. So we have used a number of existing 
systems and upgraded them, but that is not the 
whole story. There are also a significant number of 
new systems that have been implemented. 


Q36 Charlotte Atkins: But you are going to make it 
more complicated by allowing GPs to choose their 
own software and, by so doing, are you not then 
building in issues with it being difficult for those 
systems to talk to each other and so on? You have 
gone from one situation to a completely different 
situation where anything goes. 

Mr Granger: From a simplicity perspective for 
people putting in computer systems that work well 
across multiple locations, having not too many 
different types of software is good practice, because 
when you come to test upgrades you do not have lots 
of moving parts to enmesh in a complex gearbox. As 
I said, we have already got 102 different systems that 
are tested to run over this Spine, so it is already a 
heterogeneous national IT environment in the NHS 
in England. We got the message loud and clear from 
a number of GPs that their affinity for their existing 
software exceeded what they saw as the value of 
replacement, and we listened to _ that. 
Notwithstanding that, about one in ten GP practices 
now has a system that had very little penetration five 
years ago from a company called TPP. There is not 
enormous liquidity in that market place, there is one 
dominant player. It is very complex to do the data 
conversion, but we listened to what GPs wanted. 
Dr Braunold: One of the biggest challenges for me 
when I was brought in as GP Clinical Lead to do 
some of the engagement work with my colleagues 
was that clearly we had GPs (and I speak 
unashamedly as one of them): is how on earth could 
you engage GPs about something that I think is 
going to be one of the greatest opportunities for 
health gain in my generation if we get this right? On 
the other hand, GPs are at the forefront of 
computing in the world, frankly, and the risk of 
losing some of that enormously rich functionality 
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for the greater good of going to some lowest 
common denominator was the fear; so we needed to 
find a solution which would continue to engage my 
colleagues and make sure that they did not lose the 
functionality that they were enjoying as we moved 
forward. We engaged with the programme as 
Clinical Lead and said: how can we move forward on 
this issue? It was a really important issue to get right. 
The GPs System of Choice, which is the OJEC which 
is going on at the moment, which is an enormously 
important lever forward for the programme and for 
GPs and for twenty-first century computing for 
general practice, enables continued investment in 
suppliers that are able to meet the standards of the 
National Programme for IT and show a migration 
path against the things that the programme is to 
deliver. Dr Cundy, who you are going to hear from 
after us in the next session, who is Chair of the Joint 
GP IT Committee, was one of the GPs that I asked 
to go to do one of the evaluations of the suppliers 
who put in to be part of that OJEC. Unlike some of 
these European OJEC things—those things are 
usually trying to bring it down to one person to 
win—this was not an exclusive tendering. It is 
intended to be open to anybody who wishes to take 
part who can meet the standards, and as long as they 
can meet the interoperability standards and the 
standards that we require for interoperability and a 
pathway towards integration, then they are welcome 
to join in, and I am sure you will ask him some more 
about GPSoC, which has had full, wholehearted 
support from all parts of the GP economy. 
Chairman: We are now going to move on to some 
questions about timing and timescale. It might be 
appropriate if I mention at this stage that we are 
about six minutes away from what we thought 
would be the end of this session, and in the light of 
what is in front of me and around the table, that is 
not the case. I wonder if I could ask for sharper 
questions. I understand the need for you to have 
your say, but sharper questions and sharper 
answers. 


Q37 Jim Dowd: You have just stolen my line. I was 
going to say the whole of the IT project is running 
behind time and so is this session of the Committee! 
In part of the evidence it says, “The transformation 
from paper to digital information will take place 
gradually up to 2010 and beyond.” That sentence is 
impenetrable. What the hell does it mean and what 
is the significance of 2010? If it is gradual to 2010, 
what will it become afterwards? 

Mr Granger: If I could just say one thing as a matter 
of record. It is inaccurate to state that the whole of 
the programme is late. That is not true. Some of the 
programme is late, some of it is on time and some of 
it is early, and that information has been available 
and certainly the clerk of your committee had some 
information to.that effect into the progress we have 
actually made. 


Q38 Jim Dowd: Can you now answer the question 
that I asked you? 


Mr Granger: Getting hospital doctors’ paper-based 
notes on to computers, for example, or structured 
communication between hospitals and GPs, requires 
a level of consensus from the end-user community 
which cannot be ignored or ridden rough shod over. 
So, we will not have a paperless NHS for a long time, 
in fact, we may never have a paperless NHS, because 
it may not be worth computerising and going to a 
paperless environment for absolutely everything 
that we do. Less and less paper is circulating in the 
NHS. So, if you go to hospitals that have got— 


Q39 Jim Dowd: That is what it says. It does not say 
it might never be completed, it says it will completed 
but it is vague about when it will be completed. Are 
you saying this characterisation is just inaccurate? 
Mr Granger: No, I am saying it is gradual. Most of 
what we set out to do in 2002 will be completed by 
2010, but during that time a number of other things 
are now being computerised as well. 


Q40 Jim Dowd: Also the Patient Administration 
Systems have been delayed because they are 
replacing “legacy” systems. Briefly, can you tell us 
what defines a “legacy” system and why was it 
chosen to do that rather than starting from scratch? 
This must have been understood at the outset, 
surely? 

Mr Granger: There were about 180 major systems 
installed in hospitals in England in 2002 that ran the 
core administrative functions, and some of those 
have already been replaced, some of them have been 
upgraded. 


Q41 Jim Dowd: What is a “legacy” system? 
Mr Granger: A system that was already there in 
2002. 


Q42 Jim Dowd: So where it says “an existing legacy 
system”, the “legacy” word is redundant. You mean 
existing systems? 

Mr Granger: Yes. You have my apologies for the 
tautology in the drafting. 


Q43 Jim Dowd: Why was it not decided to start with 
these systems from scratch? 

Mr Granger: Because there is a vast quantity of data 
on the existing systems and hundreds of thousands 
of people trained to use them, and we cannot simply 
turn them off overnight and wait whilst suppliers 
develop new ones. The act of replacement, as I 
described a few minutes ago, is a complex process 
that, in a hospital setting, you typically have to do 
over a weekend, and you cannot do the whole of the 
country in a weekend, or you would be very naive if 
you tried. It is a gradual process. It is taking us 
longer than was envisaged in spring 2002, the 
suppliers have found it more difficult, the data 
quality is poorer than we thought it would be and it 
is a difficult job, unlike, for example, putting in 
picture archiving systems, which was not in the plan 
in 2002, which we have made excellent progress in 
and are running to schedule. 
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Q44 Jim Dowd: That leads me to my concluding 
question. We have received a number of 
submissions, one of which says that “for the first 
three years of the programme, NPfIT was driven in 
an environment of ignorance of the true NHS 
environment”. Is that why delivery of the new 
systems has slipped so far behind schedule? Do you 
respond to that as an accurate assessment of the 
position before you had any responsibility for it? 
Mr Granger: | do not know whether that is evidence 
you have received from an individual who has been 
personally disadvantaged by the programme so 
much or what the perspective is. The fact that we had 
an awful lot of staff who had 10, 20, in some cases 
more than 20, years’ experience of working in IT in 
the NHS, working at the core of the programme, 
using materials that they had developed over that 
period, I think is a statement which does them a 
great disservice. I do not recognise that environment 
at all. 


Q45 Jim Dowd: What are the main causes then for 
the delays, if it was not the fact that the whole thing 
was far more complicated than was envisaged in 
2002 and that the expertise and the assessments of 
2002 were fundamentally optimistic and inaccurate? 
Mr Granger: Some areas of the programme have got 
delays, others have not. In terms of the overall 10- 
year programme that was set out in the contracts we 
have put in place in 2003-04, we will get most of that 
work done during that 10-year envelope. I have 
talked about the fact some aspects are more 
complicated, others have been quite 
straightforward. To have gone from an NHS which 
only had about 10,000 places connected up to the 
Internet in 2003 to the delivery of a 19,000 end-point 
network which is backed up everywhere with 
secondary circuits three months ahead of schedule is 
not late and is a greater scope than was originally 
envisaged. To have completed at the end of March 
the roll-out of picture archiving across the whole of 
the south of England and London, which was not in 
the original work programme, is not late; it must, by 
definition, be early. 


Q46 Jim Dowd: One last point, Chairman, and I 
accept your exhortation about moving on rapidly. 
When you say it has got more functionality than 
originally envisaged, is that because the original 
estimates were just wrong? 

Mr Granger: | do not know of a large-scale IT 
enabled transformation programme in a complex 
organisation that from its starting point to its mid 
point has a direct correlation. I think it would be a 
fantasy to imagine. I know people write fantasies, 
but in the real world it would be ridiculous to 
imagine that halfway through a ten-year programme 
you would only be doing the same things as you set 
out five years ago. I will give you some examples in 
addition to the digital imaging. Putting in a new 
secondary uses service, putting in an email service, 
putting in the standards for GP to GP record 
transfer, putting in a new payment system for GPs, 
taking the atrocious batch legacy number systems 
that the NHS was reliant on and putting in fresh, 


modern on-line databases, putting in bowel cancer 
screening systems, none of those was envisaged in 
2002. 


Q47 Jim Dowd: The electronic X-ray storage was? 
Mr Granger: No, it was not. It was not in the strategy 
document in 2002. 

Jim Dowd: Okay, we will come back to that. 


Q48 Sandra Gidley: You have been very bullish 
about the fact that extra things have been added 
since the introduction of the system, but you have 
played down rather what has been delayed. Do you 
accept that the electronic record system has been 
delayed? 

Mr Granger: Some aspects of it have been delayed by 
24 months. 


Q49 Sandra Gidley: Is that because of taking on 
extra tasks or is there another reason? 

Mr Granger: The consultation process has been far 
longer than was originally scheduled, because the 
work that had been done in 2000 to 2002 by way of 
preparation required significantly further work. I 
will not say it was defective, but the work that my 
colleagues have done around patient consultation 
and consultation with the professionals who are 
using the system created an environment in which 
the specification that was drafted up in 2002 had to 
evolve, and until the specification was stable it would 
have been inappropriate to have got on with 
finalising the software because it would have had to 
have been reworked at a cost to the taxpayer, to 
strike a balance between consultation, a ministerial 
taskforce, professional involvement and rework 
work that had been undertaken by Anthony Nolan, 
in particular, through in 2002. 

Dr Braunold: | think it may be worth explaining a 
little bit more that some of the work that Dr Taylor 
was referring to earlier about how are we going to 
get to where we are going to in terms of the picture 
on the lid of the jigsaw puzzle, that consensus 
building about how it would work—engaging with 
clinicians and making sure that they, as people who 
are going to be using the system, has taken time to 
engage with clinicians and gain consensus about 
prioritising what will come around the consent 
model which has taken a very long time—has been 
very difficult to move forward on content and design 
in some areas when you are still having discussions 
about the consent model. 


Q50 Sandra Gidley: You have both talked about 
engaging clinicians. I found it quite interesting to 
note that the Royal College of GPs, NHS Alliance, 
the Royal College of Surgeons, the Royal College of 
Nursing, the British Medical Association, amongst 
others, all in their submissions to us mentioned that 
there had not been sufficient engagement with 
clinicians and with patient groups. A number of 
patient groups commented in the same way. Is this a 
bit after the event that we are talking? 

Dr Braunold: | am the fourth attempt at clinical 
engagement. That is the tier that I am: the National 
Clinical Lead. 
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Q51 Sandra Gidley: You are “the fourth attempt”. 
What does that mean? 

Dr Braunold: 1 will explain that. There were other 
clinical engagement efforts that happened before the 
National Clinical Lead’s appointment, three 
previous ones, and the National Clinical Lead’s 
appointment was praised in the report from the 
Public Accounts Committee and the National Audit 
Office in terms of starting to make real efforts and 
quality improvements in the clinical engagement 
with the community. We were sponsored by the 
BMA and the Royal Colleges as jointly owned 
individuals who were accountable back to those 
bodies and as named individuals that they would be 
prepared to work with who were sponsored into the 
programme. 


Q52 Sandra Gidley; How long have you been 
involved? 

Dr Braunold: Two and a half years. I was nominated 
by the BMA. I was nominated by the General 
Practitioners Committee. My job-share, Professor 
Mike Pringle, was nominated by the Royal College 
of GPs, and we two together work as clinical 
champions from the general practitioner community 
with a track record with GPs, who are accountable 
back to the profession, for making sure that systems 
are built that are fit for purpose from a GP 
perspective, and it is our responsibility to do an 
ambassadorial role for the National Programme 
from a General Practice perspective. There are 
equivalent roles. We have hospital doctor 
colleagues, Dr Simon Eccles and Mr Ian Scott, and 
we have Jan Laidlow from the Allied Health 
Professionals and we have our nursing colleagues. 
We have done quite a lot—I think it is an enormous 
amount—in terms of setting up advisory groups and 
interfaces with our colleagues and making sure that 
they are involved at every stage in every important 
programme. There is a National Clinical Reference 
Panel for the Summary Care Record for which every 
one of those colleges has been asked to nominate 
people who are able to make sure that the Summary 
Care Record has the right advice about what should 
be in it and what should be not in it and that it fulfils 
the criteria for the Care Record Guarantee, and that 
has all been slowing things down, frankly, from the 
original intention because we wanted to make sure 
that it had proper clinical sign off, and that tension 
is evident. 


Q53 Sandra Gidley: But that is only the last two and 
a half years. What engagement was there in the first 
three years? 

Mr Cayton: Could I come in here. The Care Record 
Development Board took over from two 
committees, one of which was called the National 
Clinical Advisory Board, on which every single one 
of those bodies was represented, and that existed 
well before I became involved in the programme. So, 
if that group, which consisted of the Royal Colleges 
and their colleagues, was not delivering four years 
ago, that is actually the responsibility of the 
clinicians who lead those colleges. I have had 
innumerable meetings with Royal Colleges and with 


the Pharmaceutical Society, and so on, over the last 
three years. I have had very positive relationships 
with them. I have actually found them extremely 
constructive in practice, and I think we are just in 
one of those situations where what people say in 
public (because it is a posture to take), “We have not 
been adequately consulted”, is not the same as what 
is happening in practice. We have had patient 
organisations involved throughout. Only last week 
we had an open session in which we had over 30 
patient organisations taking part, the Care Record 
Development Board has an annual conference 
which is open to the public, and to the press, and to 
clinicians, and we have had over 100 patient 
organisations and certainly over 350 people 
attending those conferences every year. We have 
actually done a great deal to try and engage with 
clinicians at all levels, and certainly, since my 
involvement, I have been personally entirely 
committed to that process. 


Q54 Sandra Gidley: How long have you been 
involved? 

Mr Cayton: The Care Record Development Board 
was set up three years ago. 

Mr Granger: It is undoubtedly the case that we could 
always do more in this space. It is undoubtedly the 
case that the concept of professional consensus 
about some of these issues is challenging. Generally, 
when you put disparate professionals together on 
some of these issues, you do not get agreement, you 
get at least one opinion per person. 


QS55 Sandra Gidley: That is within a profession? 
Mr Granger: Yes, a medical consensus is 
undoubtedly oxymoronic, but if you look, for 
example, at your profession, would you like us to 
wait until the pharmacists and the GPs agree on how 
much data would be visible in dispensaries, or would 
you like us to get on and roll out electronic 
prescriptions with the benefit that that delivers? We 
have those challenges across the whole programme 
because the tribal nature of clinical practice means 
that these different groups all take different positions 
and different postures, and we have tried to strike a 
balance around achieving progress rather than just 
wait for everybody to agree. I suspect we would be 
waiting an awful long time. 


Q56 Sandra Gidley: I gather the prescriptions are 
problematic as well, but we are not here to discuss 
that. We can probe this further with those groups 
themselves. My final question at the moment: why 
has so much effort been diverted into Choose and 
Book rather than into the detailed clinical systems 
that actually support patient choice? 

Mr Granger: 1 will ask Gillian to come in in a 
moment on this. If you look at the strategy 
document from 2002, you will see Choose and Book 
did not exist. What you will see is electronic 
booking. One of the many areas where we got 
additional work was the delivery of choice, and 
electronic booking was quite a straightforward 
proposition which had been extensively piloted, 
which was about packaging up a referral and 
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sending it electronically. The delivery of an on-line 
booking system that produces a_ confirmed 
appointment connecting up the best part of 10,000 
locations with an on-line processing system is 
something that is far more complicated. So, the task 
got more complicated with the announcement of 
choice. It is a government priority and it has been 
first out of the gate in terms of putting on-line 
connectivity into GP practices, and it\is dependent 
upon a lot of different moving parts, all working at 
the same time, only some of which are controlled 
from the National IT Control Centre in Leeds. I can 
vouch for the network, I can vouch for the Choose 
and Book system—I know when that goes down. I 
run some of the PAS systems already, I only run 
some of the GP systems. All those bits all have to 
work in order to complete the transaction. Gillian, 
you are a user of Choose and Book. 

Dr Braunold: 1 am, and I think that some of the 
issues are that Choose and Book, being the first out 
of the stable, have had to take the pain of connecting 
to the Spine. So, the first thing that people know of 
is their smartcard. I have heard so many GPs and 
colleagues around the country call it their Choose 
and Book card, because they think that this is only 
to do with Choose and Book and they do not think 
it has anything to do with the rest of what is being 
built, and actually it is their key, as guardians of 
NHS care records, of their patients’ data. It is far 
more important than Choose and Book, but it is just 
that that is the first out of the stable. It is also, of 
course, informed around whether there were speed 
problems, problems with your network or, more 
likely (which we found to be the case), sometimes it 
is actually the configuration of the computers at the 
end-user end, which does not change the experience 
of the person at the end, although it is taking a long 
time for it to work, and complaining about Choose 
and Book when actually you need to do some further 
diagnosis about what is going on under the bonnet. 
Choose and Book has had to take a lot of pain, but 
an enormous amount of the issues for me have been 
around performance managing the take-up of IT. 
Speaking as a GP here, and I do not have anything 
to do with the delivery of Choose and Book from the 
Department of Health perspective, I personally 
believe that targets are not the way to get people to 
use information technology. The NHS _ is 
commissioning tools that it expects people to use, 
and it expects people to use them if they derive a 
benefit, and I know that clinicians will use tools and 
use them to greater effect when they see them being 
beneficial. As you start to find a better use of service 
delivery because you have got a tool, it spreads like 
wild fire and people use it more and more, but they 
need to have time to grow into using those things. I 
actually believe that the rest of the service which we 
have protected from having any kind of targets, like 
the Summary Care Record, and letting PCTs go at 
their own pace when their GPs and PCTs feel ready 
to go with the Summary Care Records, is a really 
important part of how that is going to go forward 
and grow with confidence, and when people are 
ready to go they will try it out. I have no doubt that 
the value of a coded record on the.summary, as 


people see suddenly they have got access to care 
pathways because they can click on the code, will 
have GPs and patients crying out for the Summary 
Care Record faster than we can deliver it. 


Q57 Chairman: We did discuss the issue about the 
content of the Detailed Care Record when we were 
having the earlier exchanges. What do you say to 
people who say that the main plank of that—the 
PAS hospital system being developed by Lorenzo, 
Millennium—is not going to be providing what they 
were originally providing. Is that because it is a 
moving picture? This is an accusation that has been 
put to us and I put it to you to answer. 

Mr Granger: | think the problems are different. The 
Millennium product from the Cerner Corporation is 
a very rich system, as I say, in use by a third of 
hospitals across the US. There are two issues with 
that. One is the Anglicisation of it so it does things 
the way we do things here, where we want to, and in 
some cases we may want to do things differently, so 
that is a problem with that product. Can we change 
it as much as we need to and can we take the good 
things from it, which we currently do not do? That is 
a kind of process redesign issue. The Lorenzo system 
is a new build system. What has in fact happened for 
the first time under the national programme on 
Saturday morning in Ipswich was that the latest 
upgraded version of the old product was 
implemented with quite a lot more clinical 
functionality, but the core problem we have with 
Lorenzo is building a new system, a task which is 
estimated to cost around £250 million and is taking 
longer than the prime contractors that brought that 
to us (Accenture and CSC) estimated and has caused 
the company doing it (iSoft) significant difficulty. In 
the meantime, we have been getting on putting in 
systems which deliver immediate benefit and are a 
transitional step, and with that system we have a 
problem of getting sufficiently rich functionality 
developed, but we do not have a problem with 
Anglicisation because its heritage is in the UK. 
These were not unforeseen problems, which is why, 
unlike a lot of other major procurements, and not 
just in the public sector, we did not just go with one 
solution. We did not go with a plethora of solutions 
because of the cost and inefficiency of that, we went 
with a couple of solutions. It is also why we 
deliberately did not contract with the suppliers of 
those systems, because they failed financial viability 
and scale tests that we set as part of the procurement, 
and, again, you can see with the passage of four 
years the accuracy of the procurement approach, 
which we published in January 2003, and what has 
actually happened by spring 2007. It will continue to 
be difficult and, of course, if it was easy from the late 
eighties when the other major paper factories of civil 
administration in this country got computerised, it 
would have already been done. The reason health is 
being done last is because it is most difficult. 
Building the software to satisfy a highly educated 
end-user group who often have quite difficult 
circumstances around balancing time between 
accessing data, entering data and dealing with 
patients creates lots and lots of specific problems. 
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Chairman: Thank you for that. We are going to 
move on now to one or two questions about 
patient consent. 


Q58 Mr Jackson: In the pilot of the Summary Care 
Record, there is an assumption that patients have 
consented to having their data uploaded into the 
new system if they do not specifically opt out within 
a certain period. Is this approach consistent with 
patients having more control and ownership over 
their personal data? Can I just say that in evidence 
we have recently received the point has been made, 
“We are very concerned that Connecting for 
Health’s insistence that section ten of the Data 
Protection Act 1998 should remain the exit 
justification for patients who do not want a 
Summary Care Record. We believe this is counter to 
Lord Warner’s verbal assurances and also all ethical, 
professional, moral and legal principles.” What is 
your response to that? 

Mr Cayton: it is an awful lot of moral, legal and 
ethical principles to be against at the same time, and 
my first statement is I try to be in favour of most 
legal, ethical and moral principles. 


Q59 Jim Dowd: But you are not dogmatic! 

Mr Cayton: Let me start off by trying to outline the 
position that was taken by the ministerial taskforce, 
because that is the position that we are currently in, 
and also by clarifying, I hope, what Lord Warner 
said when he announced that the department was 
accepting the recommendations of the taskforce. 
The fundamental debate (and it is an entirely 
legitimate debate, and I do not think any of us have 
ever suggested that we take this in a trivial or light 
way) is a debate between the utility of having a 
system where informed consent is required explicitly 
from every person and a system where it is clear that 
consent is implied and informed consent is a matter 
of choosing not to take part. We debated that quite 
robustly in the taskforce, and it is quite clear from 
experience in other countries and in other systems 
that if you have an informed consent to be part of the 
system, then large sections of society, particularly 
some of the most vulnerable people in society, do not 
take part. They do not take part because they do not 
know how to give informed consent, they do not 
take part because they do not understand what is 
being asked or offered and they do not take part 
because of physical immobility—so older people, 
some of the frail people living at home in the 
community who might be most likely to benefit. So, 
there is that issue that arises, an equity issue, and you 
have to start by believing this is a good thing, which 
clearly we do. So, there is an equity issue. Are we 
going to deny the good thing to a large group of 
patients in the population and, secondly, there is a 
practical issue for doctors and GPs in particular. We 
did a sort of back-of-the-envelope calculation, 
which I am sure we could try to do more accurately 
if you wanted, and we worked out it would take 100 
years of GP time to go through the consent process 
for every single patient in the country. We were not 
sure that was ethically a good use of people’s time. 
We came to the agreement (and this was an 


agreement absolutely with everyone on_ the 
taskforce) that the model that we had adopted which 
said we will inform people very carefully about what 
is being done, we will give them every opportunity to 
choose not to take part if they wish to, was the most 
practical, ethical and appropriate way forward. 
Clearly there can continue to be a debate about that, 
but that is the position the taskforce took, including 
the BMA and the Society for Emergency Medicine 
and the patient organisations who were there. The 
recommendation that we should do that and that we 
should allow people who did not want to have a 
record to have a number of different positions that 
they could take: one is to have a shared record but 
not allow anyone to see it—so to have it uploaded 
but locked down so that at some stage in the future, 
should they change their mind, they might be able to 
unlock it—or not to have any data uploaded to the 
system at all. The issue that I think your evidence 
raises around section ten of the Data Protection Act 
is that we believe that the processing of data in the 
NHS is actually a requirement for the proper 
functioning of the NHS. So, for that reason, in order 
to secure the proper functioning of the NHS under 
the Data Protection Act, we merely require people to 
sign a form saying that they understand the 
consequences and the choices that they are making 
when they opt out from the system. It is not intended 
to be in any way a sort of Draconian system, it is not 
intended to ask anyone to prove anything under 
section ten, it is merely in order to secure the legality 
under the Data Protection Act of processing data. 


Q60 Mr Jackson: Thank you. That is very 
comprehensive. Chairman, could I ask two brief 
supplementaries? Have you estimated the impact of 
how many patients might opt out and what impact 
that would have on their application, and, very 
briefly, with regard to GPs, are you absolutely sure 
that there are issues about breach of confidentiality 
for GPs in the system, albeit inadvertent, and their 
liability for it? 

Mr Cayton: Let me take the first one first. Of course, 
these are only provisional figures, but there are 10.5 
million people in Scotland in the Scottish system; 
there have been 593 opt out requests in Scotland, 
which is 0.01% of the population. In Hampshire and 
the Isle of Wight system, 690,000 people, 1,050 opt 
outs, 0.15%, In the Early Adopter Programme so far 
in Bolton 0.17%, and in the Wirral 0.01%. So, we are 
talking about less than 1% of the population when 
people have the system clearly and properly 
explained to them and they know what is going to 
happen in practice. 

Mr Granger: Not the big opt out. 


Q61 Sandra Gidley: Excuse me, I live in Hampshire. 
No-one has clearly explained the system to me. I 
very rarely go to my GP. How am I supposed to 
know whether I need to opt out or not? 

Mr Cayton: 1 will turn to Gillian because she is 
working on the Early Adopter Programme. 

Dr Braunold: \n Hampshire (and it is some time ago) 
leaflets were sent to the population. I am not 
responsible for Hampshire, but we have taken some 
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learning and I can take you through how we are not 
happy to do it the way Hampshire did it, which is 
where we have been criticised for not listening. We 
have been listening very carefully to the ERDIP 
(Electronic Records Development and 
Implementation Programme) project, which 
Hampshire has been, which is one of the NHS IA 
projects on the electronic healthcare record, and 
they did a mailshot to every household. We have 
learnt from what Hampshire did, because we believe 
that it did not go to every person who needed to 
learn about it, and I have learnt more about the junk 
mail rule than I ever want to know, but it exists and 
you need to send to every addressed adult in order 
for it not to get thrown away if you have got 
Safeways or Tescos trying to tell somebody 
something at the same time. Not only are we sending 
to every address but we are sending to every adult 
over the age of 16. Originally the Information 
Commissioner asked us to write to every adult over 
the age of 18, but my colleagues in Bolton came back 
to us and said, “But we have got adults between 16 
and 18 who do not live at home”, home being with 
their parents, “they live at another registered 
address.” So, we went back to the Information 
Commissioner and said, “What do we do about 
that?” and he said, “Okay, you can send to 16 year 
olds.” So we have now sent to the 50,000 patients 
who are registered with the first nine practices that 
we have gone with in Bolton. We have written to 
everybody, not only those who are 16, but 
everybody who is going to be 16 over the first three 
months of the pilot, and they have been sent 
addressed leaflets. But we do not rely just on that 
leaflet campaign, we have to then do other methods 
of communication within the area. There have been 
lots of newspaper articles and other methods of 
getting into communities that are going on at the 
moment in Bolton. We have been stuck a bit by 
purdah. I am being perfectly honest. From March 15 
onwards has not been a brilliant time because we are 
now in purdah, and until May 4 we cannot do much 
more in terms of a public information programme in 
Bolton; but the minute we get past the May 
elections, we are allowed to do something that is 
being interpreted as political process because of the 
political nature of this discussion that we are in now, 
so we will be able to do a much wider advertorial 
campaign. We are doing information booths and a 
public information programme within Bolton where 
people are coming in, for instance, to Lever 
Chambers and they asking in depth questions. We 
have sent out around about—. You have got the 
figures, Harry, of how many leaflets we have sent out 
to people in Bolton. There have been requests for 
something like 900 sets of confidentiality packs from 
the Bolton population from the 50,000 that we sent 
out and about 400 of those were altogether from 
people who had various difficulties, and I think 
about 60 of those have gone to people with limited 
eyesight—Braille versions and large print—so we 
know that we are getting there. One fact that you 
might find interesting is that I thought maybe people 
were not reading the leaflet. You know, you send a 
leaflet to people houses. How do we know they read 


the leaflet? Unfortunately, we got one letter wrong to 
one practice. It said that they were registered with a 
different practice. We had hundreds of phone calls 
from patients who said, “You say I am registered 
with practice X instead of practice Y.” So they were 
doing some reading of the material that we were 
sending them. Nevertheless, the whole project is to 
be evaluated to check, not only the consent model, 
but the quality of the information programme that 
we are doing, because the consent model is 
predicated on informing the population and, if the 
population is not informed, the consent model is 
inappropriate. So, we have an_ independent 
evaluation that has been commissioned that is 
starting on | May, and that will look at all the 
different communication methodology that we are 
using in Bolton, and it is not just an evaluation for 
Bolton, it is the whole Early Adopter of the 
summary record in its first year that is being 
evaluated, and we are testing different methods of 
communicating with the patients who are being 
affected. 

Mr Cayton: The Care Record Guarantee is now 
available in 16 languages, and we are increasing the 
number of languages as we go. I have brought some 
examples here if you would like to see them. 


Q62 Mr Jackson: I did not get the second part 
answered about the concerns that GPs have. 

Dr Braunold: Very briefly, 1 did 22 road shows with 
Professor Pringle across the country and we had 
concerns from GPs around the time taken to 
consent, which was, I think, the biggest concern that 
people had. So, what we are doing with my 
colleagues is looking through the data quality, which 
is really important, so that they do not inadvertently 
send erroneous information. We know that the 
dataset that is being uploaded in bulk is the drugs 
and allergies. The reason we have chosen that (and 
it took some discussion with colleagues across the 
country about going for that model) is because the 
drugs and the allergies are likely to be the most 
accurate subset of information. We are all using 
datasets, formularies, if you like, so it is not free text, 
and it is very likely to be accurate, whereas the 
summary of the significant medical history has the 
potential to be inaccurate, and that is why it is not 
going in a bulk, it is going opportunistically one by 
one so that there is the checking of that by the patient 
and the doctor before it is submitted. Part of the 
model is that those are only submitted after a 
conversation with the patient, and how that is being 
done is being worked through by our colleagues on 
the ground who are prepared to put that pain in to 
testing different models and seeing which works 
the best. 


Q63 Chairman: Thank you for that reassurance, Dr 
Braunold, that a leaflet delivered through a letterbox 
is actually read. It is something that some of us have 
doubted from time to time in this profession. I would 
like to ask you very quickly what level of consent will 
be required for the Summary Care Record data for 
secondary purposes such as clinical research? 
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Mr Cayton: The law will not change in any way 
whatsoever, and the law is clear that patient 
information can only be used for clinical research 
with consent or entirely anonymised, or, 
exceptionally, with the permission of the Patient 
Information Advisory Group which gives section 60 
approval as part of the 2002 Health and Social Care 
Act. The two grounds on which the Patient 
Information Advisory Group will give consent, 
which is obviously a parliamentary matter, is if it is 
clear that getting consent is either impossible or so 
onerous that it is not appropriate and the public 
benefit of the research is so great that it justifies 
doing the research without getting consent. There 
will not be any difference whatsoever in the legal 
position of people’s data in terms of research with an 
electronic system than from now. I am just grabbing 
this back, this particularly useful piece of paper. To 
put this in context, Biobank, you will be aware of, 
has recently started to invite members of the public 
to take part in research. I have to say I was 
personally quite sceptical and I have been quite 
interested by the fact that 10% of the people mailed 
by Biobank in their pilot in Manchester actually 
responded positively to the invitation to take part in 
research, and, although a number of those people 
(and again I am surprised how few but I think it is 
interesting) wanted to know how their name and 
address came to be selected and wanted to know who 
had sent out their name and address, of the very 
small number—23 who wanted to know how they 
had been selected, 25 who wanted to know how their 
name an address was obtained—after they had had 
a discussion with Biobank 50% of those people 
continued to go forward to take part. So, I think 
what this is suggesting, not in any way that we 
should move away from consent for research, which 
I think is very, very important, but that the public in 
this country still have very strong communal interest 
in clinical research and in a common ownership of 
the Health Service, which I think is one of the 
wonderful qualities of our Health Service, that it is a 
joint enterprise and not a set of private contracts. 


Q64 Dr Naysmith: Good morning. Mr Granger, I 
understand that it is proposed that patients will be 
able to put some or all of their data into electronic 
sealed envelopes if they choose to do so, but I also 
understand that the technology to allow this to 
happen does not yet exist, is that not rather 
astonishing? 

Mr Granger: Is it astonishing it did not exist by 2002, 
or is it astonishing that it does not exist yet? 


Q65 Dr Naysmith: Is it not astonishing that it does 
not exist yet? Is it an oversight that we are starting 
talking about it and yet the technology is not there 
to do it? 

Mr Granger: No, because the consent model which 
you have heard about around the Summary Care 
Record has dealt with whether people would like 
their information withholding or not and the variety 
of arrangements there, and I think we circulated 
some information to you around that. It becomes 
necessary as we move into segmenting a record with 


the detailed information that will follow as the 
system evolves. It is difficult to specify, difficult to 
develop and it reflects the views of certain groups of 
patients and certain groups of experts, and I think as 
we go through the evaluation process with the Early 
Adopters we will get a better understanding of 
whether we have got .2% of the population 
potentially driving a very large amount of 
expenditure on computer software when 99.8% of 
the population have a very simple requirement that 
the NHS treats them as safely and as efficiently as 
possible. So, I think the sequencing is rational based 
on the way the programme is going. 


Q66 Dr Naysmith: When will the sealed envelopes 
become available? When will that technology be 
available? Are you saying that it might not if it is 
such a small proportion that it does not matter? 
Mr Granger: The current proposal is that the Spine 
central infrastructure software release programme 
in April, May 2008 will deliver the central 
functionality for sealed envelopes. I do not wish to 
mislead the Committee. You must recognise that the 
systems that feed in and out of a central system will 
also have to be upgraded to comply with that, and 
one of the challenges we have is that this is not a 
requirement in other jurisdictions. We have got a 
plan to deliver it. 


Q67 Dr Naysmith: Is it a requirement anywhere else? 
Mr Granger: | am not aware of other— 

Dr Braunold: 1 think in France there is a sealed 
envelope functionality. My French is limited, but 
what I read of a translated grid showed a sealed 
envelope functionality with the two levels of 
sensitivity very similar to the one that we have 
suggested here, and I think some of the delays that 
Mr Granger was referring to—. We did a risk 
assessment of the original sealed envelope proposal 
through our clinical safety arm of Connecting for 
Health, and it became very evident that we were at 
risk of breaching the very confidentiality that the 
sealed envelopes were there to protect if people did 
not use them properly. So, you have got this balance 
of business process and the human beings in the 
NHS who are not used to this new way of thinking 
that might well not use the software properly when 
we design sealed envelopes to protect patients’ 
particularly sensitive items. The other risk was that 
if we did not have the functionality right, then large 
swathes of the population would opt out because 
they would have no confidence in the system. By 
opting out I mean that they would choose not to 
share their information. We did some work with the 
technology office and with clinicians around the 
sealed envelopes proposal that I have given you as a 
power point, and I am well aware that the 
Committee is running late and I am very conscious 
that you probably do not want me to take you 
through it, but what I would like to say is that we 
have proposed two levels of sensitivity there, a 
normal sensitive barrier that would give an audit 
trail if somebody opened it who did not have express 
permission to open it, and a sealed and locked 
version where it is not even visible outside of the 
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work group you are in. We took that to the most 
challenging group of doctors of all that exist—not 
just doctors, clinicians I should say—the Sexual 
Health Conference that the CFH ran last month, 
who are the most sceptical that the confidential data 
that they deal with in the GUM clinics will not be 
adequately protected. We took them through the 
sealed envelope proposals that we have and how we 
think it will work and we asked \them in the 
evaluation: “On the basis of what you have heard, 
would you support your local sexual health service 
using the NHS Care Record Service? Please scale 
your answer using (1) not at all to (5) very much.” I 
will submit this as a note, but the evaluation showed 
that 23.8% were on three, 23.8% were on four and 
26.2% on five, and the people who were on not at all 
or the next grade up were 2.4% for each of those 
categories. So, we were very, very pleased with that 
outcome for the most challenging group, that when 
we explained our proposals for simplifying the 
sealed envelope structure but making it fit for a 
purpose, we think that we have got the technical 
specification right for the service. 


Q68 Dr Naysmith: You still have not answered my 
question when you think it will be. 

Dr Braunold: Two thousand and eight. 

Mr Granger: Software drop, April, May 2008. 


Q69 Dr Naysmith: You are confident you will meet 
that target? 

Mr Granger: BT have delivered every one of their 
central software drops on time for the past 18 
months. There was lots of delay before that, but this 
has become quite a reliable delivery environment 
now. 


Q70 Dr Naysmith: I understand you also 
commissioned a risk assessment report last year 
suggesting that it would be best to hold information 
like this locally rather than on a central database? 
Dr Braunold: That was the risk assessment process 
that I was referring to, which looked at how would 
we use it and were there risks associated with it; and 
we redrafted it in line with the recommendations of 
that risk assessment report. 


Q71 Dr Naysmith: So it does follow that? 
Dr Braunold: Absolutely. 


Q72 Dr Naysmith: You were talking about the 
presentation you let us have. On the last page it says 
that information in sealed envelopes can be pulled 
off for anonymised secondary user purposes, but 
SUS information data is not always totally 
anonymous, is it, because it includes postcodes and 
date of birth? 

Dr Braunold: That is what pseudonymised is. 
Pseudonymised, which is one of my most 
challenging word to spell, means you could get to 
some part of the demographics without knowing the 
full name and address of the patient. 


Q73 Dr Naysmith: But someone can find the full 
name and address of the patient from date of birth 
and postcode information? 

Mr Cayton: | would just repeat the point. There is no 
difference in the legality or in both professional and 
legal frameworks. This is a process of clinical 
research now and there are very, very strict 
guidelines. My view is that because of the audit trail, 
for instance, and some of the other securities that lie 
within the system, the new system should actually 
allow better use of fully anonymised data. I should 
say, there is a secondary uses working group of the 
Care Record Development Board which will report 
in the next month or so, and that group contains a 
large range of both patients representing sensitive 
issues, such as mental health and HIV, and 
researchers and clinicians. It is chaired by Sir Robert 
Boyd and I am looking forward to receiving their 
report which will have a number of suggestions, I 
think, to even further increase the safety and security 
of the use of records for clinical research, which I 
think we all want to achieve because it is in all our 
interests to continue to do clinical research, 
including on mental health and HIV. 


Q74 Chairman: I think we are down to the last 
question, and I would like to ask it of you, Mr 
Granger. We have had a number of submissions that 
you will be amazed to know about that say there 
should be an independent technical review of the 
national programme. How do you respond to this? 
Mr Granger: | am interested as to whether the people 
calling for that are, indeed, themselves independent. 
We have been as a programme the subject of 
significant scrutiny, both from the NAO and the 
Office of Government Commerce and a number of 
reviews which we have commissioned as a 
consequence of events or concerns that have 
occurred over time. Ministers took a decision last 
year that there was no benefit in a further review of 
the programme being undertaken, and that was the 
position that was set out by Lord Norman Warner 
in the spring of last year. 


Q75 Chairman: A technical review is a bit different 
to reviewing all the issues that are floating around in 
the media quite a lot of the time. Is that your 
understanding in terms of overruns? Would it seek 
to get answers to questions that some people believe 
remain unanswered. 

Mr Granger: We know from 350,000 people using 
systems that did not exist four years ago with billions 
of pieces of information flying around the network 
that did not exist, with hundreds of thousands of 
people using a security framework that did not exist. 
At what point do we get to a situation where people’s 
research tool, which is Google, is actually thrown 
out? They would not go shopping for health advice 
on Google, but they somehow consider that they can 
vicariously analyse the performance of a programme 
using generally inaccurate press coverage. I am not 
sure. Do we have to get to 500,000 users? This 
programme was always going to be very challenging; 
it has been very challenging; it will continue to be 
very challenging. Where there is specific expertise 
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that is going to work from an evidence base and 
improve what we are doing, reduce errors, reduce 
time overruns, I would say with the time overruns 
that one of the problems with this programme is 
there was no financial contingency. So, as a 
programme director, quality, functionality and time 
are the three things that we have to deal with and the 
only expression of dealing with problems on this 
programme is necessarily time, because we are 
operating within a financial cap and_ the 
functionality demands have tended to increase 
rather than decrease. If there are people who want to 
work from an evidence base, the door has always 
been open for them to come and work with us, but 
people who just lob cold collations of negative media 
coverage in so-called dossiers hardly do themselves a 
service as a serious group of people that are working 
from a robust evidence base. 


Q76 Chairman: They and others around could 
influence public opinion about this problem. 
Mr Granger: Undoubtedly they do. 


Q77 Chairman: Would such a review increase, or be 
likely to increase, public confidence in the 
programme? 

Mr Cayton: Might I just come in there and say that it 
seems to me that—. I have always said that the Care 
Records Development Board deals with the issues to 
which there is no right or wrong answer, only the 
best answer we can come up with. If there was clearly 
a right answer to some of these difficult issues, then 
we would not need committees and we would not 
need inquiries to look at them. It is only because they 
are, inevitably, contested issues, both in ethical 
terms, in terms of good clinical practice and in terms 
of the functionality of IT systems in the modern 
world. My feeling is that, through the systems we 
have got in place, there is a very robust system now 
of involvement and engagement through the Care 
Record Development Board and the National 
Clinical Leads and a large amount of public 
scrutiny, which I welcome, because I think the kind 
of scrutiny this Committee gives is part of a proper 
process of examination of what the programme is 
doing, we have to move forward on that basis. If we 
keep going back and saying, “Because I disagree 
with a decision that has been reached through a 
public and accountable process, I now want to 
unpick everything”, we will never deliver and the 
people who will, I think, not forgive us are our 
children, who live in an IT enabled world now and, 
I have to say, will be very surprised if in 50 years’ 


time we are saying to them, or perhaps not us, but 
our children’s children are saying to them, “Oh, we 
gave up because it was too difficult.” 


Q78 Jim Dowd: Given the scale of the undertaking, 
as you have described it, given the novelty of a lot of 
the approaches, how much of your system’s software 
is dot zero releases in the operating systems that are 
out there? 

Mr Granger: None of the operating systems, because 
they are either industry standard proprietary 
systems or LINUX. In terms of the application 
software, almost all of the applications that are 
being delivered are systems that have been deployed 
extensively previously or are incremental upgrades 
of things which were deployed previously. In terms 
of the core Spine infrastructure, there was some 
mythology in the Health Informatics Community 
that the standards existed, HL7 was mature, and so 
forth. That was completely untrue. We have had to 
put an awful lot of effort into specifying the 
standards for messages, around demographics, 
around booking, around prescriptions, and then the 
software that BT have built with a number of sub- 
contractors is brand new software that has been 
custom-built for the NHS; so that is high-risk, new 
build software. There was no other way of doing it. 
I am very pleased a number of other jurisdictions are 
getting very interested in using that. What I do not 
want us to end up with in the NHS is a situation we 
have in a number of other areas of civil 
administration where we expend a significant 
amount of money building something which, when 
it comes up for re-tender, we have a unique supplier 
and we either have to pay to get other people to come 
in and bid in order to have a competition for the 
replacement, or we are held to ransom at the point 
of replacement. What we need to get to is a 
sufficiency of open standards, which we are leading 
a lot of jurisdictions on, so that when we come to re- 
tender these systems at the end of the contract there 
is a vibrant market of suppliers in a number of 
jurisdictions and we do not face that risk on an 
enduring basis because we are sharing software that 
is used in other places. I think, in particular, the 
Welsh Assembly will have some very interesting 
choices when we turn off the systems on which they 
are dependent, starting next year, as to whether they 
use the English solution or they go and build from 
scratch something that does the same thing. 
Chairman: Could I thank the three of you very much 
indeed for coming along. I am sorry about the 
overrun in this session. I thought it was likely to 
happen in view of the inquiry. Thank you very much, 
again for coming along, and I hopefully it will not be 
too long before we have our report out in relation to 
the Electronic Patient Record. 


Witnesses: Dr Martyn Thomas, visiting Professor of Software Engineering, University of Oxford, Mr 
Andrew Hawker, NHS Patient, and Dr Paul Cundy, Chair, General Practitioners’ Joint IT Committee, gave 


evidence. 


Q79 Chairman: Could I welcome you very much 
indeed and, first of all, apologise for the lateness of 
the hour in terms of this evidence session. I do not 
have to tell you why, as I understand all three of you 


have been sat in the room for the last couple of 
hours. Could I welcome you to our now second 
evidence session of the Health Committee’s inquiry 
into the Electronic Patient Record and, for the 
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record, | wonder if I could ask you to introduce 
yourselves and the positions that you hold. Could I 
start with you, Andrew Hawker? 

Mr Hawker: Certainly. My name is Andrew 
Hawker. I am now retired. Since Mr Granger seems 
to take a slightly paranoid edge about some of the 
things he says, could I stress that for much of my 
career I worked in selling and installing systems and 
taking flack in much the same way as he does, 
although for much smaller types of system, and 
latterly 1 worked in a university. 

Dr Cundy;: | am Paul Cundy. I am a GP. I am the 
Chairman of the Joint IT Committee for the BMA 
which represents GPs in the UK and IT issues. In the 
same paranoid sense, I should also declare that Iam 
the owner and manager of a niche software company 
that sells to PCTs and other GP system suppliers and 
practices? 

Dr Thomas: 1am Martyn Thomas, and I am here on 
behalf of the UK Computing Research Committee, 
which is an expert panel of the British Computer 
Society of the Institution of Engineering and 
Technology and of the Council of Professors and 
Heads of Computing in UK Universities. 


Q80 Chairman: Once again, welcome. Could I start 
with a question about the strategic direction of the 
national programme. You have heard the answer to 
this question, but I would like to put it to the three 
of you. The Government is now clearly planning to 
introduce a central Summary Care Record and a 
local Detailed Care Record in relation to the 
programme. Why are two systems necessary? I do 
not know who would like to start. 

Dr Cundy: | am quite happy to have a bash. I 
recognise your Committee is recognising the volte- 
face of the programme, because certainly it was true 
in 2003, when it was first announced as a national 
programme, it was going to be a single record 
accessible to anyone anywhere when necessary 
under the famous three pillars. We now have a very 
different description, as has been described by Mr 
Granger, and that is a description which we 
welcome, but certainly general practice believes that 
what we should be doing is connecting together the 
electronic islands that are out there already. So, we 
believe in a concept of interoperability, and that, 
therefore, defines each organisation having its own 
detailed organisational record which has a high 
degree of relevance to the users in that organisation 
which exchanges’ snippets of information 
(summaries, if you like) through standard-based 
messaging with other systems where necessary and 
when necessary. The concept of the Summary Care 
Record is a concept that some people believe will 
improve patient safety, and that began as a concept 
of having a brief extract of terribly important 
relevant details available wherever you are 
externally to the local detailed record. The concerns 
that we have about that is that the Summary Care 
Record is turning out to be far from a summary care 
record. We are aware that there are already, even 
before the evaluation of the pilots is completed, 
suggestions that the Summary Care Record should 
also collect data from Choose and Book (i.e. 


referrals data) and also possibly the electronic 
prescriptions service. So it is already looking like far 
more than just a summary record. If that is the case, 
that raises enormous concerns about consent 
arrangements, because people are being consented 
against a summary. It also raises concerns about 
how you manage a multi-contributor, a multi- 
organisational record, which is something which has 
not been tested before. I believe that there should be 
local detailed records at the level of organisation and 
whether you want a summary care record or not is 
possibly a worthwhile experiment. 

Dr Thomas: As computing experts, we simply do not 
want to comment on the clinical need because it is 
not our expertise. What concerns us is the fact that 
a very large programme is underway when the 
specification is not yet clear and keeps changing. At 
best, that is a grossly inefficient way of developing 
large IT systems and, indeed, of bringing about 
large-scale organisational change and, at worst, it is 
a way that cannot succeed, but time will tell. 


Q81 Chairman: On that issue of the specification 
changing, you suggest Dr Cundy, that you are 
unhappy with the model of X number of years ago 
which was going to be a national Spine with 60 
million patient records on it accessible from Lands 
End, not quite to John O’Groats because it stops at 
the Scottish border, but, anyway, Berwick or 
beyond. It seems, under those circumstances, that 
has changed. You are suggesting that the summary 
situation might be a bit difficult for you as well. I 
used the expression “political compromise”; maybe 
I will drop the politics out of this. It was a consensus 
that had to come about because some parts of the 
profession did not like the idea of patient records 
being, presumably, beyond the immediate 
institution that they live in. Is that a crude and wrong 
analysis of the situation? 

Dr Cundy: It is a perfectly fair observation. Whether 
it is true, I think I would dispute. I think one of the 
points to make is that general practitioners have 
enormous experience of dealing with complex 
electronic records. Despite the description that Mr 
Granger gave of general practice systems at the 
moment, they are world-beating systems. I have a 
system that I can go from the documents, the letters 
on my patients, through the pathology results in a 
couple of mouse clicks to a graph of all their blood 
pressure observations since inception. We have now 
recently developed technology, through a project 
which was begun before the national programme, to 
exchange GP records wholesale from one practice to 
another. Six hundred practices in the country have 
that, and it is almost getting on for 10%, and that 
exchange can occur in a matter of minutes. If you 
can exchange information, share information in that 
fashion, that therefore must question your concept 
of sharing information under the programme, which 
is to put it all into one single bucket which may 
represent mirrors of information held elsewhere and 
control access to that bucket. We believe that is 
something which has been untested but we suspect it 
is something which is probably unmanageable and 
potentially unsafe because, if we pick up on a point 
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which was made earlier, different doctors need 
different information. As Gillian Braunold said, I do 
not want to know every single potassium result from 
a patient of mine while they spend ten days in the 
cardiac dependency unit of the local hospital. What 
I want to know is that they went in, when they went 
in, what the diagnosis was, when they came out and 
what drugs they were on, and that can be sent to me 
in acompletely different way to my having to go into 
a single large data repository. 


Q82 Chairman: It strikes me—this is a general point 
about the programme—that it is ambitious to say 
the least, but if you go back hundreds of years in 
medical history, some of the things that doctors were 
doing at the time which made major breakthroughs 
people were sceptical about. People turned round 
and were questioning what even their peer groups 
were doing in terms of whether that was the right 
thing to do, and yet at the beginning of the twenty- 
first century, certainly in this country, life- 
expectancy and everything else (until in quite recent 
years we have children and obesity) has been pretty 
incredible in terms of the extension of it, and the 
quality of our life as well has greatly improved 
because of people doing things for the first time. 
Quite frankly, if people were questioning it on the 
basis, “We do not think it will work”, or, “It might 
not be manageable”, we may not have made the 
progress through the centuries that we have done in 
society in general and throughout the world. Do you 
not think that this sort of questioning of potentially 
every little minutiae is something that is non- 
progressive, for want of a better expression? 

Dr Cundy: 1 am not a Luddite. Most GPs are not 
Luddites. We are actually pushing for things. Even 
now that the programme is not delivering the 
programme we would like to deliver, we have been 
pushing. That is why our systems are so well 
developed. I think sometimes the problem is that the 
agenda we are pushing for is a different one, and that 
may be because of the position we inhabit in the 
NHS, which is that we are the guardian of the life- 
long record. I totally agree that you have to try 
things, but do you want to conduct your experiment 
on 56 million patient records or do you want to try 
some pilots first; and the initial proposal was an 
experiment on 56 million records, and that was a 
view that we did not share. 


Q83 Chairman: I will move on. I want to ask 
specifically Andrew Hawker. You argue that all 
clinical information should be held locally with only 
a unique patient identifier on the central system. 
What would be the advantage of this approach? 

Mr Hawker: | would echo the earlier comment: you 
then have absolutely no doubt to whom that 
information belongs, who is actually managing it, 
accountable for it, and so on. It seems to me that we 
are drifting almost into a situation where you have a 
hybrid system, you have local and national records; 
itis not clear to me who actually is finally responsible 
for one or the other. Also, at the same time, and I 
hope we will come back to this, we are being invited 
to give, in effect, two kinds of consent. There is one 


sort of consent if it goes on something called a care 
record, but there will be some other kind of consent 
process for the local record—that is as it comes 
across to me—and both of these do not seem to be a 
very well thought out philosophy. 


Q84 Chairman: Dr Thomas, you wanted to say 
something? 

Dr Thomas: Yes. It seems to me that there are two 
issues that are being run together here. The overall 
objectives of the system seem to be trying to tackle 
two problems in parallel and those two issues are 
perhaps in conflict. On the one hand, there is the 
question of putting in good IT to support the 
clinicians supporting the patients, and I think 
everybody in the NHS is entirely behind that. Where 
IT can improve healthcare, it is sensible to deploy it 
once you are in a position to be able to be able to roll 
it out without disturbing things too much. There is 
also the issue of transforming the way that the 
Health Service operates and the way that the Health 
Service is managed and the need for information to 
be available in order to be able to change the 
management structures. I suspect that there are a lot 
of stakeholders throughout the Health Service who 
are resistant to the notion of change of management. 
That would be absolutely normal in any large 
organisation. Bringing those two things together 
and trying to use the IT programme as a facilitator 
for bringing about managerial and organisational 
changes that have not already been agreed is, in my 
experience, never successful. 


Q85 Chairman: I am very tempted to refer you back 
to the report we did on workforce planning, but I do 
not think we will go there. We are trying to get some 
sleep without the thought of it at the moment! Is it 
not really saying the Summary Care Record we are 
getting is basically because the Government has 
admitted it can produce what it wanted to do in 
terms of a national electronic record and, in a sense, 
they have failed to do that and so this is the 
compromise that I talked about earlier? 

Dr Thomas: \ was listening very carefully to the 
answers you got when you were asking your earlier 
witnesses about that and it seemed to me that they 
contained a lot of contradictions and lack of clarity 
about what they really were trying to do. The notion 
that you could introduce a Summary Care Record 
and then use it as the Local Care Record, because it 
had the flexibility to enable local care groups to 
upload whatever information they wanted to and 
could agree to actually share amongst themselves, 
looks to me like a specification creep that is highly 
likely to undermine the security policies that are 
being put in place: because now you are starting to 
handle data, where at the time you designed the 
security policies you did not necessarily know that 
that data was going to be available in that record. 
So, whilst I sympathise greatly with the motivations 
of Mr Granger and his team and their enthusiasm 
for using modern technology (and I sympathise very 
strongly with the difficulties they have got in actually 
working out exactly what they can do and on what 
timescales and what is practical), to do it in the 
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context of a national programme with declared goals 
and declared roll-out targets and declared 
implementations in hospitals across the country and 
then actually to run a programme which is 
exploratory in nature is just a backward way of 
running a very large project, it seems to me. I 
imagine Mr Granger has got trapped into it by the 
politics of it. lam not accusing him of incompetence 
at all, I am saying that, having seen what is 
happening, we need to back off and say; “let us plan 
this, so that we can maximise the progress we can 
make and minimise the financial and timescale risks 
and contingent damage that we might do to the 
Health Service in the process”. 


Q86 Chairman: How do you get large projects if you 
do not do it like this? 

Dr Thomas: Every large successful project is grown 
out of a successful small project. 


Q87 Dr Naysmith: Can I ask Dr Thomas a very 
quick question. I have seen quite a few computer 
projects over the last ten, 15 years in local 
authorities, in universities and in government, and 
almost every one suffers from this “specification 
creep” that you are talking about. As people get to 
know about a project they want to bolt new things 
in. It happens, in my experience, in every computer 
project, whether it is large or small, and the clever 
thing to do is to manage it and stop it at the right 
point. Is that nonsense or is there some truth in what 
I have just said? 

Dr Thomas: There are two sources of specification 
change. One is genuine specification change where 
people discover new requirements or, while a project 
is actually being developed, the world changes 
around them and they have to change it; and the 
other is specification changes that occur simply 
because you did not investigate the specification well 
enough at the beginning and, therefore, you discover 
holes in your own understanding of what the 
situation always was and always would have been. 


Q88 Dr Naysmith: What I am putting to you is that 
nearly always happens? 

Dr Thomas: It nearly always happens because the 
current style for developing a computing project is 
simply broken. If you are building a large building, 
which can very often be an organisational change 
process as well, what you do is bring in an architect 
and the architect works with you to really 
understand your requirements. They formalise those 
requirements, they come up with high level design 
and, in the process, they uncover all sorts of 
conflicts, contradictions, things that you had not 
heard of. They can bring to bear their own 
experience in those sorts of buildings, help you to 
really understand your requirements; then they 
move round to your side of the table and actually put 
out a contract to procure the building that has been 
designed. We do not do that at the moment in IT 
systems. We put out a contract to procure on the 
basis of the ill-founded, contradictory specifications 
with holes in and then, astonishingly, it goes wrong. 
Of course it goes wrong. 


Q89 Dr Naysmith: So your criticism is not just of this 
project, it is of nearly all? 

Dr Thomas: \t is of nearly all projects, but this is a 
project where perhaps we have got a chance of 
saying: “Hold your horses. We can get to where you 
want to get to faster, cheaper and at lower risk if we 
simply reassess what you are doing and can get rid of 
some of the baggage of having to live up to promises 
made by people in the past.” 


Q90 Sandra Gidley: A question for Dr Thomas. 
Your submission argued that the electronic records 
system should be introduced as a series of small 
systems that can be built up into a national system 
rather than what is happening. The Government 
seems to be doing the complete opposite of what you 
are advocating in your submission. 

Dr Thomas: Yes. Really what I am saying is what I 
said earlier: that successful large systems grow out of 
successful smaller systems. I do not want to really 
propose technical solutions because I do not believe 
that the specification, the requirements, are really 
very well understood yet. So, my instinct would be 
to do lots of prototyping and work with the 
clinicians in the frontline to really find out what 
works for them, what they are happy with, what 
works with their patients, and then to stand back 
and decide what you want to do on a national basis, 
talking to a group of people who now understand 
the power of the technology better because they have 
worked with the prototypes, and where you have 
managed to evolve specifications that have come out 
of the real experience of the clinicians who will need 
to use them. 


Q91 Sandra Gidley: I may have misunderstood. I got 
the impression that you were talking about different 
systems joining together potentially, which would 
surely have problems if they did not interact with 
each other? 

Dr Thomas: It is generally a better architecture for a 
large system to have a lot of individual components 
which can then fail independently, because fail they 
will, without actually causing widespread 
disruption. So, if you can build large systems out of 
small systems which intercommunicate in a standard 
way, that gives you a much more resilient 
architecture. One of our concerns is that there does 
not appear to be an overall dependability case for the 
national programme. 


Q92 Sandra Gidley: A dependability case? 

Dr Thomas: There does not appear to be a structured 
argument that says: here are the quantified goals for 
the availability of the system, for the reliability of the 
overall system, for the accuracy of the data, for the 
number of security breaches that are tolerable— 
those sorts of issues—and here is a structured 
argument based on sound evidence that the systems 
we are building will actually deliver those quantified, 
dependability objectives. A group of us asked Mr 
Granger whether such a case was being prepared, 
and he said he did not have the information to do 
that because it was actually proprietary to his 
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suppliers. Therefore his team, by implication, was 
not in a position to assess the dependability of what 
they were buying. I was taken aback. 


Q93 Sandra Gidley: There are no examples in the 
past of the sort of approach you are advocating 
failing? 

Dr Thomas: \t would be an appalling thing to do, to 
claim there are no examples of any kind of system 
architecture failing. I think the computing 
profession has managed to fail in almost every 
conceivable way so far, and no doubt will continue 
to do so, but that is true of all new engineering 
disciplines. You learn from your failures. 


Q94 Chairman: Can I ask you a quick question, Dr 
Thomas. You wanted everything at the beginning of 
the journey, as it were, which is the ideal world for 
anybody who is involved in engineering—and I am 
a lapsed engineer given that I have been in politics 
for a long time now—but what was described this 
morning and what I picked up now and again were 
issues that are add-ons to this system like electronic 
imaging transfer. There are some clinicians who feel 
it is just a wonderful thing to happen. With the 
model set out and writ down large at the outset, 
something like that would presumably have been 
blocked, “Sorry, we cannot do it because it is not 
what we have set out to do”, which is very reassuring 
from an engineering point of view that this is the 
project that you are going to deliver over time, ef 
cetera. So, from an engineer’s point of view, would 
it limit the ability to be able to do things like add-ons 
that we have heard about this morning? 

Dr Thomas: Clearly you are not a lapsed engineer: 
once an engineer you are always an engineer; the 
engineering understanding will never leave you. 
Jim Dowd: It is just that he was not a very good one. 


Q95 Chairman: Which is how I ended up here, but 
that is by the by. 

Dr Thomas: | am not suggesting for a moment that 
you should have come up with a specification for all 
the things that you wanted to do that was completely 
locked down and that you were not prepared to 
change. 


Q96 Chairman: I just wonder, if it was an add-on in 
the view that it was not thought about when people 
sat round in a room and developed this, a system 
that was rigid would block it off. 

Dr Thomas: No, | think the programme could quite 
reasonably have said: “There are a lot of point 
solutions in healthcare. We are introducing specific 
systems to support specific activities that are actually 
independent and do not need to be highly connected 
into other parts of the system or the overall 
architecture. It would be a very powerful thing to do, 
so let us have a budget for doing that because they 
will come up.” One of my concerns about the way 
that the programme is going is that it is in danger of 
locking itself out of the advances that will be made 
in the availability of healthcare systems around the 
world. In setting out to be a leader and to develop 
standards which it hopes will be adopted elsewhere, 


there is a danger of investing a very large amount in 
architecture, in software, and so on, which rapidly 
becomes obsolete in that other people have come up 
with better solutions and you cannot easily swap 
them in because you have built something that is too 
highly integrated. 

Dr Cundy: I think that one of the significant failings 
of the programme was that they did not consult with 
the user-base whilst they were developing their 
specification. A good example of that is that, whilst 
Mr Granger in his first year was dealing with the LSP 
contracts, we were negotiating our new GP contract, 
and we signed that off in April 2003. The contracts 
for the LSPs were signed off in November 2003 and 
it was not until after that that someone said to him, 
“Did you not know that there are things in our 
contract that you have got to deliver”, such as the 
add-ons that he was talking about, QMAS, GP to 
GP, and he did not know about those; and the LSPs 
were going round giving presentations to GPs 
saying, “This is a system we are going to give you, 
something fantastic. It will give you pathology 
results”, and the GPs were saying, “We have had 
that for five years.” PACS is another good example. 
Many of the PACS systems being installed now are 
the PACS systems that were on order books in 2001 
to 2004 that were put on hold because a new 
programme came along. They are essentially the 
same systems. They will be the eighth version, but 
they are basically the same product but under a 
different procurement mechanism. What happened 
was the programme came along, said, “We are going 
to do this”, and trusts said, “We actually need a 
PACS system”, so that was then brought in. The 
failure was not adequately understanding the 
market that Mr Granger was procuring for. He went 
out and procured, under his experience of procuring, 
where he has procured before, but he did not put 
enough time into consulting with the users what it 
was they needed to deliver the programme. If that 
had been done, we would have had a much more 
incremental “building on what we have already got” 
approach, which I think would have been more 
successful. 


Q97 Mr Amess: Listening to you three gentleman, I 
think it is a great shame that the three previous 
witnesses cleared off as soon as you started. I would 
like to have seen the six of you together, a bit of 
creative tension, and got the inquiry off to a bit of a 
bang. All they are going to have to do is read about 
what you have said, but it cannot be helped. Where 
is your practice, Dr Cundy? 

Dr Cundy: | am in Wimbledon Village, a very 
informed and affluent population. 

Mr Amess: It sure is. 


Q98 Jim Dowd: Hardly part of the inner city, is it? 
Dr Cundy: No. 


Q99 Mr Amess: Dr Cundy, is it a good thing that 
general practitioners will be offered a choice of 
suppliers for their electronic record system and does 
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the decision to offer choice represent a change of 
direction by Connecting for Health and will it mean 
a less centralising approach to these issues? 

Dr Cundy: It is not a good thing because it is 
illustrating the precise point I was making earlier. 
Our new contracts specify that GPs would have a 
choice of system from a list of accredited systems. 
That was negotiated between 2002, signed off in 
2003. In 2003 Mr Granger signed contracts with the 
LSPs but did not have GP choice in them. It has 
taken us three years to get to the stage where we are 
now, where we are about to let the contracts with the 
GP suppliers that will give us what should have been 
delivered in our new contract of 2003. From that 
point of view it is a very good thing, because it is 
what the Government is delivering on what it 
committed to three years ago, but from the point of 
view is it a good thing as a result of the programme? 
No, it is not, it has been held back three years by the 
programme. If they had properly consulted the 
market place, we would not be three years late with 
it. Is it a good thing that we have lots of different 
systems to choose from? Yes, and we have been 
through this iteration before. I have been in IT now 
for far too many years, Chairman of the IT 
Committee for 11 years and I have seen this thing 
cycled. Prior to the programme we had a thing called 
RFA (Requirements for Accreditation), which was 
an attempt to get systems to work together to 
common standards. That largely failed because the 
procurement side of it was not aggressive enough, 
did not have enough teeth. That resulted in a market 
place where there were about 31 different systems 
that you could purchase from. Mr Granger’s 
intention was to throw all those away and have, 
effectively, two or three systems for everyone. That 
has rolled back and we now have a situation where 
yesterday we were evaluating applications from nine 
different systems, which is probably a healthy and 
vibrant market. It means we will have suppliers who 
will have to be competing in a properly funded 
market, on a level playing field, simply on the basis 
of user functionality, and that is, in my opinion, an 
ideal position to get to, but it is a position which we 
negotiated in our new contract, it was not delivered 
to us by the programme. 


Q100 Mr Amess: It does not reflect very well at all on 
the gentlemen responsible for this and it is a very 
poor example of joined up government. Is there a 
financial cost in all this in terms of the delay and the 
less than satisfactory approach? 

Dr Cundy: My only comment is that we offered to 
meet Mr Granger very early on after he was 
appointed in early 2003 so that we could explain to 
him that we had---. This is addressing another point 
he made earlier. General practice views on what GPs 
want for IT are actually very clear-cut. There is one 
committee, it has representatives from the Royal 
College, GPC, which is effectively the union, and 
people who use systems. We have a very clear 
established structure for defining what we want, 
which is how we were able to very clearly place it in 
our new contract. If he had come to us and said, 
“What is it you want?”, we would have given him a 


very clear picture and it may be that the LSP 
situation would have been different, but it may also 
be that he was told, under political direction, not to 
deliver it. I do not know. One can become very 
paranoid. 


Q101 Mr Amess: Very interesting. How I wish he 
were here now to respond to those points. Finally, 
Dr Cundy and Dr Thomas, if general practitioners 
are to have a choice of supplier, should not hospitals 
and other care providers also have a choice? I am 
sorry you are being left out of this, Mr Hawker, but 
you have got more fish to fry later. 

Dr Cundy: Yes. 

Dr Thomas: Yes, I would think that is almost 
certainly the best solution. 


Q102 Chairman: It leads me into a question in 
relation to that. I looked at news of IT in my local 
health economy in the mid nineties. I went to my 
local hospital, which is now a star via Gerry 
Robinson on BBC television, Rotherham Hospital, 
and they have just installed a wonderful PAS system. 
I actually watched a nurse fill in electronically the 
discharge, and got the keyboard out, for a patient 
who was going to be discharged from that ward on 
that day, and I said, “That is wonderful.” I said, 
“How long will it be before it gets to her GP”, and I 
was told that actually the discharge letters are 
printed off at night, on the night shift, when the 
hospital is quiet and hopefully patients are sleeping, 
and sent out to their general practitioner by mail. I 
said, “What if someone wanted some immediate 
help in the community, like a nurse to call round the 
day they get back at home’? “We phone the local GP 
up and tell them, or tell the local district nurses that 
this individual might need that type of help.” That 
was choice inside the National Health Service in the 
mid 1990s, but my hospital system did not have the 
ability to talk electronically, to send the discharge 
papers through to the local GP surgery that was 
involved in the care of that patient once she had left 
Rotherham Hospital premises. People have a 
responsibility and ministers and others have a 
responsibility both to patients in those 
circumstances and to taxpayers, but choice is 
coherent, in as much as we are able to have systems 
and IT in the National Health Service that does have 
the ability to do pretty fundamental things like talk 
to one another and assist patient care. Would you 
dispute that? 

Dr Cundy: No, I would not. I became Chairman of 
my committee in 1995. In July 1995 I coined the 
phrase at the British Computing Society Primary 
Healthcare Group “the electronic islands of the 
NHS” and the concept of interoperability is 
precisely what you are talking about. You want the 
electronic island of hospital to be able to 
communicate a meaningful message about a patient 
to the electronic island that is relevant (i.e. the 
general practice), but it could be the chiropody 
service or the speech therapist, and that is precisely 
what interoperability is about and I believe that is 
precisely what you are seeing the programme now 
moving towards. 
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Q103 Chairman: “Moving towards”’—after 10 
years? 

Dr Cundy: That is the message that I heard from Mr 
Granger’s submission, but interoperability is a word 
that we were bandying around in 1995. 


Q104 Chairman: It seemed to me from, both a 
patient care point of view and a taxpayers point of 
view, that both of these institutions in terms of the 
hospital, the acute and the primary sector at local 
level were funded out of general taxation no matter 
how it was procured, but there was no link up 
between procurement and it is complete nonsense, as 
far as I was concerned, from the use of public money. 
From the point of view of the GP surgery, I have no 
doubt that managing patient records electronically, 
et cetera, as opposed to Lloyd George’s records, was 
a lot better—I accept that entirely—but the ability 
for patient care seemed to be lacking in that respect if 
we were relying on phone calls and somebody being 
there to receive the phone call because Mrs B was 
being discharged that day. I actually thought that 
that is what the national programme was about, to 
make sure we did not have that. In a sense it was 
choice, but it was sensible choice on systems that 
were compatible, or interoperable, as we now call it? 
Dr Cundy: Y ou will be interested to know that in the 
late 1990s there was a pilot in Kettering where they 
did precisely do that, they created an electronic 
discharge for somebody that was communicated 
electronically within seconds to a local GP surgery. 


Q105 Chairman: Why do you think the delivery of 
the new electronic record system is so far behind 
schedule? 

Mr Hawker: | wish I knew. I was hoping to find out 
this morning, and I am not really very much clearer, 
Chairman. 

Jim Dowd: We ask the questions. We do not give 
the answers. 


Q106 Chairman: None of us came into politics to 
answer questions. Dr Thomas. 

Dr Thomas: At the time when the schedule was 
established, they did not know what it was that they 
were trying to deliver. They had a view as to what it 
was, but it was not a clear view and it has changed 
subsequently. It is clear, just from listening this 
morning, that the specification is still evolving. 
Under those circumstances, any schedule that you 
put together, any plan for delivery, is built on sand 
because you do not know how long it is going to take 
you to do something if you do not know what it is 
you are going to do yet. 


Q107 Chairman: But it must be the case with a lot of 
IT programmes, small or large, that things evolve as 
things go on. Back in the eighties I sat down and 
talked to software engineers, and I was asking them, 
“Could you do X and Y?” and we used to add things 
on on quite a regular basis because it was not set. In 
actual fact, do you think, as somebody involved in 
this, that even parameters agreed now, there will not 


be the same parameters in five years’ time, they will 
have moved on, because it is not a set thing, it is an 
evolving thing, is it not? 

Dr Thomas: Yes, but you need to look at the context. 
If you are building a single system for a single group 
of users and it does not need to be highly 
dependable, then you can use what the industry 
these days calls ‘agile methods’. You can actually 
work with the users evolving the requirement, 
building things, delivering functionality, and every 
week you give them additional functionality. If they 
do not like it you come in and change it. You can 
work with people to deliver that, but that would 
involve having teams of people working with each 
delivery site developing systems that were unique to 
them. That is not what the national programme set 
out to do and, in an organisation the scale of the 
Health Service, frankly, I do not think it would have 
been practical to work in that sort of way. Also, you 
have real problems with the properties of systems 
that are system level properties. Things like security 
are only partly dependent on the security of the 
components, they are really properties that emerge 
from the integration of components into an overall 
system, and, therefore, you really do need to plan 
those carefully from the beginning and to 
understand what it is you are trying to achieve in 
those areas from the beginning. The approach that 
you are describing works wonderfully if you are 
building an individual website for a commercial 
customer. It would not have worked in this context. 


Q108 Chairman: No, we would not have had the 
interoperability that we have with this system. 

Dr Thomas: No, you do need some central planning 
for the standards, for interoperability, of course. 
Chairman: I think we are going to move on a little 
now to patient consent and ask Richard to come in. 


Q109 Dr Taylor: I hope you will allow me to make 
two comments before I move on to patient consent. 
I am echoing David. It is so good to have you three 
after the bland platitudes we had from the first lot— 
absolutely refreshing. We were told user 
involvement was there from the beginning, and you 
said obviously it was not. Delays have been caused. 
All the communications were in place in the early 
1990s in some hospitals, so it is very refreshing. I 
wonder if Dr Thomas would agree with one of the 
experts who has written to us: “To an experienced 
computer person this system bears all the hallmarks 
of massive failure. It is simply too big to design, plan, 
estimate, manage, implement, verify, install and 
keep alive”? 

Dr Thomas: Yes, 1 would agree with that, the way 
that it is going. I do not think it is impossible to 
deliver high quality IT systems to support the Health 
Service, but I do think it is important to be clear 
what you are trying to do and, in particular, if part of 
your objective is to transform the way the clinicians 
work, then you better design new ways of working 
and get them agreed before you try to build the 
systems to support those ways of working. 
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Q110 Dr Taylor: Thank you very much. I will move 
on now to consent. Mr Hawker, you have been 
particularly worried about this. Do you think 
patients are being given enough information to 
make sensible decisions about whether their data 
should be placed on the record or not? 

Mr Hawker: If 1 could move to the Care Record 
Guarantee, which earlier, I think, we were given to 
understand is the measure of reassurance that we are 
meant to have before signing up for the Spine, there 
seem to me one or two things that I would challenge 
within the guarantee. My first problem with that is 
that I do not actually believe some of the things it 
says. Secondly, a guarantee, so-called, would 
normally be forever. You do not buy a washing 
machine with a guarantee and then a year later 
receive a new version that says, “We have decided 
after all we do not really feel like doing this 
particular kind of repair”, or whatever, whereas 
there have been changes over the past five years. In 
2003 we were all being told that you have a right to 
object to information being passed on, even if it is to 
someone who might provide essential health care— 
that is 2003—and then the first version of the 
guarantee said, “You can choose not to have 
information in your electronic care records shared”, 
but the version we now have has this interesting 
word, “Usually you can choose to limit how we 
share the information in your care records.” I am 
sitting at the bottom of the pile reading these things 
and feeling a little uneasy, because I am being given 
this document that we are assured everybody reads 
avidly. I find that very hard to believe, because I have 
read it many times and it is absolutely covered with 
question marks and things that I do not quite 
understand are going on. 


Qlll Dr Taylor: Could we know what the 
document is? 
Mr Hawker: Yes, it is the Care Record Guarantee. 


Q112 Dr Taylor: Is that sent to everybody? 

Mr Hawker: | believe so. I would stress this is called 
a “guarantee” of how your records will be handled, 
and it may be premature to raise some of the things, 
but it does, for example, say that security will be 
operated in line with internationally approved 
information security standards. I have various 
reasons for not believing that, for one thing. 

Dr Thomas: It is effectively a meaningless claim. It is 
not of any technical significance to say that. 


Q113 Chairman: No, but you heard the witnesses 
saying earlier that anything that is done with this 
patient record will be covered by, if you like, the law 
and the regulations of this country and international 
as well. Is that not saying the same thing? 

Dr Thomas: Yes, and strongly implying that that 
meant no change to the position that the patients are 
in, but once the records are electronically accessible 
the demand for secondary use goes up and the ease 
of secondary use goes up, and so a lot of patients 
whose privacy was never really under threat with 
paper records, because it would simply have been 


too hard to go and trawl through large numbers of 
those records, are now potentially at risk without 
having changed the legal framework. 


Q114 Chairman: That could be said of an electronic 
doctors practice that has got 10,000 patient records. 
It would be very difficult for you to go scooping 
through all of Lloyd George’s records to find these 
individuals but you could go straight into— 

Dr Thomas: Absolutely. I do not have the data, but 
it may be that the police are now routinely asking 
doctors to give them searches on that data, or it may 
be that it is legally privileged. 

Chairman: I am sorry, Richard. It is not normally 
something the Chairman does. Please carry on. 


Q115 Dr Taylor: Mr Hawker, you mentioned a 
Department of Health standard letter and the words 
“concerned” and “distressed”. Is there a separate 
letter, or is that still this blue document? 

Mr Hawker: \ was sent a document which was 
headed, rather ominously, “If I do not have a 
Summary Care Record”, in block capitals, and then 
proceeded to tell me how dangerous that would be 
for me. I do not want to read the whole thing, but 
that was the tone of it. It contains a rather interesting 
sentence which says, “Information in your Summary 
Care Record could save you and the NHS time, but 
it could also one day save your life.” So this is not 
just making minor politics, I do not think. It carries 
on, “The NHS has significant problems with lost 
records and test results, treatment and prescribing 
errors and they lead to thousands of preventable 
deaths and injuries.” This is quite ominous stuff, but, 
frankly, I cannot see the connection. If we create an 
SCR are we being told that this will eliminate all 
these lost records and test results? Some of them are 
the very things that feed into the SCR, 1.e. errors in 
prescribing. Are these all going to be reduced or 
eliminated simply because we have an SCR. I feel the 
whole tenor of this is over the top. 


Q116 Dr Taylor: You heard the previous witnesses 
saying 0.001% of people were going to opt out. I 
forget the figure; it was a not as low as that. Do you 
think they were accurate with that? 

Mr Hawker: | do not know. I can only speak for 
myself. I am clearly one of the .2%, which on a quick 
calculation I make to be 100,000 people, which is a 
whole constituency full, so I do not feel that is a 
trivial number; but I think here, if you set aside all 
the political arguments and commercial argument, 
we have to come back to whether or not an 
individual patient has the right to say, “I do not want 
information handled in a particular way”, and I was 
very disturbed to hear the sort of argument that says 
98% of people are going to come round, therefore 
these other troublesome people should be swept 
aside. That is really taking the IT and making the 
policy fit round it, and it really ought to be entirely 
the other way round. 
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Ql17 Dr Taylor: You are absolutely right. Dr 
Cundy, will GPs agree to upload their systems onto 
the big system without specific consent from 
patients? 

Dr Cundy: | do not know. The initial indicators from 
most recent studies are that GPs remain extremely 
concerned about it. A question was asked, I think by 
Mr Jackson, about GPs’ potential liability if they 
upload information without knowing whether the 
patient wants to or not. I believe that contradicts my 
professional responsibility to protect patients’ data. 
One of the leading medical defence indemnity 
organisations, the organisations that insure GPs 
against claims of negligence, has just issued guidance 
saying that if the GP is not absolutely certain that the 
patient fully understands and has been fully 
informed, then he will be liable. I find one of the 
difficulties about the scope of that, one of the 
difficulties in this consent debate: it is certainly true 
that the level of people wanting to opt out of the 
Summary Care Record, as it is currently described to 
them, is very, very low. I think that there may be an 
element of apathy about that, but I certainly know 
that in my practice patients are more and more wary 
about what is happening. In fact I actually now have 
patients who look at the screen, and I say to them, 
“You are not happy about what we are recording”, 
because they believe that is connected to the 
Government’s computer system. I think that if the 
Summary Care Record just says you might be 
allergic to penicillin and you once had a sleeping 
tablet for a night flight, that maybe is fine, but if it 
starts becoming a detailed, almost mirror copy of 
not just a GPs record, because they are proposing to 
link it to other things (so it has got copies of 
everything from everywhere), it then becomes a very 
comprehensive record in relation to which | think 
patients’ view on their consent may change. 


Q118 Dr Taylor: Is it realistic to get that degree of 
consent from patients? Presumably it was the MDU 
or the MPS that said this? 

Dr Cundy: It was the MDU, yes. The debate about 
whether you should opt in or opt out, ultimately, if 
you read through everything they have ever 
produced, comes out to one argument, and that is 
work-load and rate of uptake. Their own advisory 
panel said the only argument against it is the rate of 
uptake. If you have a summary care record, I would 
like to know in what way is my safety enhanced by 
your record being there or not being there because I 
am the patient? So, if I am the only patient on the 
Summary Care Record and I trip over Mr Granger’s 
carpet in Bradford and my life is saved because I 
have a Summary Care Record, my life is not 
threatened by the fact that yours is not there. 
Therefore, there is no communal safety element; it is 
simply for the individual to decide. Therefore, why 
do you have to have an overnight, one-day bulk 
upload of everything? Most patients will see their 
GP within three years—statistically 90% of patients 
will see their GP within three years. Therefore, why 
cannot you say we will have a slightly slower upload, 
we will take it on a patient by patient basis? When 
the patient next comes to see their GP you can 


discuss whether you want something going on, you 
can do it slowly over time, and in taking that 
approach, which is a default opt-in approach, you 
slowly build the system and that allows time for trust 
in the system to be developed. One of the problems 
I have with this system is that it is being imposed on 
us. In every other element of the NHS we have 
choice. We can see who we want, when we want, 
where we want and have what we want done to us 
except for your record, and that makes me slightly 
paranoid. Why do they want to do that? So, I would 
advocate having a default opt-in so everyone is not 
uploading. As people see their GPs they can then 
decide to opt in. That spreads out the workload 
argument as well. 

Dr Taylor: The point about choice is a very good 
one. 


Q119 Jim Dowd: Does it exist now with written 
records? 
Dr Cundy: It exists in the sense that— 


Q120 Jim Dowd: It is the property of the clinicians 
and they decide what happens to it. That is what 
happens now. 

Dr Cundy: At the moment with a paper record, you 
only have one choice of where you put it. In fact my 
contract says, if I write it, I must write it on a piece 
of paper sent to me by the Secretary of State, on the 
MRE, but, yes, you are absolutely right, at the 
moment if the clinician wants to write a record he 
can actually write it wherever he likes. 


Q121 Jim Dowd: And share it with whoever he 
chooses? 
Dr Cundy: He can, indeed. 


Q122 Dr Taylor: But, in theory, the patient has 
access to all the written notes that are kept now? In 
theory. 

Dr Cundy: No, they have a legal right of access. 


Q123 Jim Dowd: So is the fact that it will be so much 
easier for them if they have got access to their own 
electronic records going to improve the quality of 
care, make it more difficult, affect security? 

Dr Cundy: | do not know, I have no doubt, I think 
that is why, to a certain extent, this is an experiment. 
What I know from my system in my practice is that 
there are times when I, quite frankly, do not have an 
immediate clue as to what is going on with a patient, 
and we have 20 years worth of patient electronic 
records. Electronic records can be just as confusing 
as any paper record can be and in my practice I run 
it very rigidly: my partners are not allowed to do 
certain things. Despite that, we can still sometimes 
find it very difficult to not know what we are doing 
with a particular patient. It can take quite a long 
time to unravel it. If that is my record on my system 
that we managed, if I am having to navigate 
information on a system that is run by someone else, 
contributed to by lots of different other people, I 
have no idea whether that will be easy or not. I 
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suspect it might be potentially difficult, but the 
answer is I do not know whether it is going to make 
life better or not. 


Q124 Chairman: Can I ask you, Dr Cundy, do you 
think that summary records have any potential for 
research or planning in healthcare or do you think 
they should not have? 

Dr Cundy: | think that records should \be used as the 
law currently stands, which means that, if they are 
anonymised records, then I cannot see any reason 
why they should not be used for research, but if they 
are not anonymised, then I do believe that patients 
should have consensual rights over them. 


Q125 Chairman: Have you had that debate within 
your field, the people that you are working with 
within this area, about how you could use summary 
records for research and planning in healthcare? 
Dr Cundy: No, I do not think you can use the 
Summary Care Record because that is clearly 
identified. 


Q126 Chairman: What record would you use then? 
You have got 20 years of electronic records in your 
practice. You must have some idea about the well- 
being or not of a large section of Wimbledon, would 
you not, and what has happened over decades in 
terms of healthcare and interaction with drugs in 
your patients. 

Dr Cundy: Yes. 


Q127 Chairman: Would it be good to measure that, 
do you think? 

Dr Cundy: Yes, indeed, and we do that on a routine 
basis on a variety of parameters, but that is a 
different arrangement. They are patients of my 
practice, so it is entirely legitimate for me to do that 
and there is an assumption about consent. I thought 
what you were asking about was something like 
SUS, which is a large aggregation of data from 
different sources, and that being used for research. 
The circumstances are clearly laid out in law, which 
is that it should only be used if it is anonymised or 
with explicit consent. 


Q128 Jim Dowd: Could I ask Dr Thomas to start 
with. I have seen your very distinguished academic 
record. Have you ever designed and built any 
systems yourself? 

Dr Thomas: Personally designed and built systems, 
yes. 


Q129 Jim Dowd: What sort? 
Dr Thomas: Not medical systems. 


Q130 Jim Dowd: No technical systems. What were 
they? 

Dr Thomas: The company Praxis that I founded 
many years ago did do some medical systems 
development while I was Chairman. 


Q131 Jim Dowd: I am sure they did, yes, but what 
did you do? 
Dr Thomas: | have worked on— 


Q132 Jim Dowd: Can you give us some idea of the 
scope and the scale of the systems you have dealt 
with? 

Dr Thomas: | have worked on large-scale operating 
systems. We have built things for ICL, for example. 
I actually programmed part of the UNIX 
implementation that ICL put in as a subsystem of 
their large operating system. Mostly, in recent years, 
I have just been managing systems development 
rather than doing it myself, but, again, some pretty 
large-scale stuff I have been involved in. I also have 
audited some large systems. I audited, for example, 
the new en route air traffic control system that was 
put in down at Swanwick that got into some 
difficulties. Indeed, it is actually the independent 
review of the Swanwick system that is my worked 
example of the way that a select committee can bring 
about a sensible action by calling for an independent 
review. Gwyneth Dunwoody’s committee instituted 
that and QinetiQ carried out a thorough review of 
that system, and it was very helpful. 


Q133 Jim Dowd: From what you have said and given 
the evidence we have received, not just today but 
beyond, there is no consensus in what this system 
should do: some people have one view about what it 
should do and some people have another. Does your 
prescription of attempting to find that consensus 
before deciding how to progress really match up to 
the reality? 

Dr Thomas: Yes, | think it does, because I think that 
there is decades of experience which shows that any 
other solution has a very high risk of failure. 


Q134 Jim Dowd: Most things in life do. Does that 
surprise you? 

Dr Thomas: | think there is plenty of evidence that 
trying to do organisational change by building 
computer systems fails and there is plenty of 
evidence that building large-scale computer systems 
without getting the specification sorted out at the 
beginning fails and fails with a much _ higher 
probability than if you go about it the other way 
round. 


Q135 Jim Dowd: But if you have a system that meets 
the maximum requirement expected from the user 
group as well as the minimum, rather than just the 
optimal, surely you satisfy everybody? 

Dr Thomas: \n order to be able to do that you would 
need to know what the requirements were; so you 
would still need to engage with the user community 
to find out the requirements. Whether it is then an 
appropriate thing to do to try to build the most all- 
encompassing system you can and give it to 
everybody, or whether it would be better to have a 
number of different subset systems that people 
actuaily chose between, is a debating point. I would 
go for the smaller systems, because you do not 
want— 


Q136 Jim Dowd: How do you define “better” and 
“worse” in your use of language? 
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Dr Thomas: More dependable, more cost-effective, 
more likely to achieve the overall objectives within a 
reasonable cost. 


Q137 Jim Dowd: So you are an optimalist rather 
than a maximalist? 

Dr Thomas: Yes, | am an engineer and engineering 
is a business of making engineering trade-offs. To 
make sure that you achieve the maximum you can 
from the minimum expenditure with the highest 
degree of reliability. 


Q138 Jim Dowd: That has clearly changed from 
when I was involved in it, because our objective there 
was to give the customers what they wanted and ask 
them to pay for it. 

Dr Thomas: \t has moved on from that, because the 
professional societies now require that engineers 
take things like safety and general professional 
behaviour into account rather than just selling 
people snake oil. 


Q139 Jim Dowd: BT say that a Central Record 
System will be almost impossible to breach. You cast 
significant doubt on that. What reason do you have 
for that? 

Dr Thomas: It is very difficult to build secure systems 
and keep them secure. There is a real tension 
between ease of use and security. The more secure 
you make a system, the harder it is to use because 
you have to go through more checks in order to be 
able to use it. If the intention is to make individuals’ 
records available on the Internet, in order that 
ordinary members of the public can check their own 
record, any mechanism that is really robust and that 
would stop people being able to break through and 
check somebody else’s health record would 
necessarily have to be quite hard to use and, 
therefore, finding the appropriate trade-off there is 
certainly difficult and may even be impossible. It 
may be that if you had targets for how hard it should 
be to read somebody else’s health record on-line, it 
would turn out that you could not build a system 
that was easy enough to use to make it worthwhile 
having a system at all. One of the things that 
concerns me about the programme is that there is no 
definition of what is an acceptable level of security 
breach. You heard Mr Granger this morning saying 
clearly that no system would be ultimately secure 
and, therefore, he accepted that there would be 
security breaches in his systems. But I have asked 
him directly whether he has targets for what would 
be an unacceptable level of security breaches, and he 
says, “No, I have not.” That seems to me to be a 
mistake, because if you do not know how tolerable 
it is for a security breach to occur, you do not know 
how much effort you need to put into building 
systems that are adequately secure to meet your 
targets because you do not have the target. So what 
do you do? Do you go for perfection, which is 
certainly going to be unachievable but, in any case, 
is going to lead you down the path of spending vastly 
more money than you need to have spent, or do you 
take whatever level of security comes out of the way 
that you are going to be building the systems within 


the budget, which may lead to a level of security 
breaches that turn out to be unacceptable in practice 
and cause you to have to take the systems off-line? 


Q140 Jim Dowd: But your conclusion on the 
inevitability of a breach is not based on any 
knowledge of the systems and the architecture that 
BT have employed but really on a reductive process 
of experience of previous systems? 

Dr Thomas: Absolutely. Nobody outside BT, as far 
as I am aware, has any insight into the detailed 
architecture and security policies for the systems 
they are building. It is confidential. 


Q141 Jim Dowd: Nobody outside the BBC thinks 
they are perfect either, so the idea of getting a 
solution, I think, will be elusive. Dr Cundy, 
smartcards and role-based access controls providing 
effective security in GPs surgeries. Do you agree 
with that and, if not, what systems do you think 
should be put in? 

Dr Cundy: It has been shown already to be a 
nonsense. We said that when you issued smartcards, 
unless they were instantaneous in their ability to 
access the record you need, they are going to be seen 
as an imposition, as an obstacle. That is not such a 
problem in general practice, but in places like A&E 
departments where patients come in and there is a 
very rapid turnover and delivery of care, we 
predicted that what would happen is that someone 
would come on shift (a hospital doctor, a nurse, a 
hospital administrator), they would slip their 
smartcard in, and they would need it, and everyone 
would just access the records. That is precisely what 
has happened and, what is more, it has happened 
with the local agreement of the PCT and I think also, 
I have to say, the local medical committee. 


Q142 Jim Dowd: It is not the smartcards themselves 
at all, it is the people who use them? 

Dr Cundy: It is the people working around 
something which is seen to be an imposition, and it 
is part of the trade-off between security and 
usability. In a general practice it is possible to insist 
that people log out. We do not actually use the 
smartcards but you log out when you leave the 
screen, but in some busy departments it will not be 
possible. In a theatre, for instance, if a surgeon is 
operating he might want to know some information 
about the patient, what does he do: de-glove? So you 
have immediately got a conflict in what is called role- 
based access. 


Q143 Jim Dowd: What happens presently in a 
theatre when the surgeon runs into a problem and 
needs further information? 

Dr Cundy: He will probably ask a junior doctor to 
look through the record; but I think the argument 
you are heading towards is, because it is not done as 
well as it could be done now, we should not deal with 
the systems of the future to be better. 
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Jim Dowd: That is completely the reverse of my 
position, but I am only asking questions. What is 
happening with smartcards is learning to work 
around them, and so what we need is ever better 
security technologies. 


Q144 Chairman: Can I pursue that a little bit. Is it 
better technologies? Is not the truth of the case in 
and around IT that most of the major security issues 
are human driven? 

Dr Cundy: Absolutely. 


Q145 Chairman: Is that the case, Dr Thomas? 
Would you agree with that? 

Dr Thomas: There are two main causes of security 
breaches in socio-technical systems, by which I mean 
big computer systems embedded in organisations. 
The human factor is an enormous one. If you want 
to break a system the thing to do is to corrupt an 
insider or just to trick an insider, but if you have 
actually got access to the interfaces to the system and 
you want to make a technical challenge, then it is 
usually programming errors, not even design errors 
but stupid low-level programming mistakes, that 
give you the ability to break in. That is why systems 
become vulnerable to viruses and worms, for 
example. 


Q146 Chairman: What happened in banking? My 
personal bank account records have been electronic 
for years now, as has presumably the Prime 
Minister’s and everybody who works in_ this 
establishment and everybody who works in the UK. 
There are all these things, not about the human side 
of it all, about the secure side of it. Why has it not 
failed? It does not appear to have failed, or has it 
failed? 

Dr Thomas: Yes, it has failed. There is a high level 
of banking fraud. The banks regard it as confidential 
information and the policy in the banks is not to 
have a higher level than the other banks. They do not 
go for a financial level of fraud reduction. What 
Barclays care about is whether their record is worse 
or better than HSBC, but also they care about who 
is liable for it. It is really a liability issue. One of the 
main reasons for bringing in chip and pin is that it 
enabled them to offload liability back on the 
customer. 


Q147 Chairman: That was a fraud about somebody 
in a restaurant not doing with my card what they 
should have done. This was not about the system, 
this was about the input into the system. Is there not 
a difference when you are talking about security of 
IT systems? 

Dr Cundy: Can I comment on that? 


Q148 Chairman: | was asking the engineers to start 
with, and then I will come on to you two. 

Dr Thomas: | do not really understand the question. 
Banking security gets corrupted in all kinds of ways 
by phishing attacks on-line. 

Jim Dowd: No, that is a software problem. It is a 
problem with the people who respond to it; it is not 
a system problem. It is the fact you get an email from 


somebody who you believe to be your bank wanting 
all your details and passwords, and some people are 
gullible and stupid enough—they are probably the 
people who ring up daytime TV game shows and are 
wasting their money doing that as well—to turn 
round and say, “Yes, I will send you my security 
code”, or sending credit card details to unsecured 
sites! 


Q149 Chairman: That is the difference to the security 
of the system then. You are saying that the security 
cannot be used as well. My comment is, from a 
technical point of view, is this going to be as secure 
as a banking system, not that somebody in a 
restaurant is going to create fraud by disabusing my 
credit card when I go to pay my bill? That is a 
different issue. 

Dr Thomas: It is very important to consider that the 
system is both the technology and the people who 
interact with it directly. The moment you start 
focusing just on the technology and on the security 
of the technology, you miss most of the real 
problems both in building and making secure. 


Q150 Chairman: Should we not go back to live in 
caves then? Would that be a good idea? 
Dr Thomas: No, absolutely not. 


Q151 Chairman: Where do we not go back to live in 
the cave and where do we have an IT system sat in 
my Office over the road there? Where is the judgment 
on that? 

Dr Thomas: | am not arguing that you should not 
build IT systems and embed them in organisations. 
What I am saying is that, in deciding what the 
specification for the technology should be, you 
actually need to start by looking at the specification 
for the overall social system and deriving the 
specification for the technology out of the way that 
people are genuinely going to behave when faced 
with the technology. I have been on the steering 
board for the dependability research project that 
EPSRC (the research council) has been running, and 
one of the things that they have done, a big project 
out of Newcastle, is to send their ethnographers to 
hospitals to sit and observe for days the way that 
people do actually work with the systems that they 
have got in hospitals; and what you see all the time 
is that people do not use the systems the way that the 
people who develop them expected them to do. The 
moment it appears to them that the systems are 
getting in the way of them doing their job, which 
they see as treating patients and running the hospital 
effectively, they start working around the systems. 
The way in which people work around the systems 
fall into well-defined patterns, and the psychologists 
and the social scientists have got a very good handle 
on the kind of work-arounds that people will use 
when they start to run into problems, like sharing 
smartcards, for example. So, you can actually design 
your technical systems in the knowledge of what will 
happen under overload situations or crises or where 
people are just having a bad day and are not working 
very effectively. You have to do that. The airlines did 
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not manage to get the accident levels down without 
taking account of the kinds of errors that pilots 
made. 


Q152 Chairman: Andrew. 

Mr Hawker: Comparisons with banks, I think, have 
come up a few times this morning and there seem to 
me just one or two dangers. I think Mr Dowd has got 
his finger on one pulse, and that is that the banks can 
do a straightforward financial analysis. They can 
decide: “We will spend this much on security; that 
will balance against this much we will lose in fraud.” 
You cannot do that with personal records because 
once my history has escaped it is there, and if it is 
actually on the Internet it is there for everyone, and 
that is quite a sobering thought. We are seeing, for 
example, teachers being the victims of websites 
organised by their pupils. What happens then if that 
medical record finds its way onto a site of that kind? 
I feel at some points we are not looking at the way 
that technology is happening outside this little world 
of NHS IT and the way that can have an impact on 
people, but that is not a problem the banks have. So, 
if you are trying to make comparisons, I think 
another useful one might be to look at the kind of 
internal audit system you will tend to have in a bank 
and the rather specialised and skilled people that 
they would employ to do that; and I can find no 
evidence that within the NHS we have an equivalent 
kind of privacy skilled auditor internally who can do 
the sort of investigation and monitoring which 
forms a part of this social total structure of security 
which will make me start to believe some of these 
things in the Care Record Guarantee. What we do 
have is a steady drizzle of bureaucracy coming out of 
the Information Governance Toolkit. Chairman, I 
have read all that. There are 100 different criteria 
that you meet. You score yourself on those. You go 
up from one to three on each one and there is a huge 
problem with that because some of those one, two, 
three steps are absolutely crucial, like having an 
information assistance officer or a Caldicott 
Guardian, others are pure paper work, but you get 
the same points for each, you add them all up and it 
goes into a traffic-light rating. Guess which ones 
people will go for? The other assumption I worry 
about is that you have all this intense activity but it 
is all very superficial and it does not add up to a 
coherent whole. You can score your 70%, or 
whatever it is, but it does not really mean that you 
have got the right sort of focused activity within the 
trust, or the practice, or wherever, and that is where 
I think you could learn a good deal of lessons from 
the banks because they have been doing it for longer 
and there are certain types of people I can identify 
working in the banking system who are in some ways 
a worthy adversary for many of the people who 
attack systems. They are able to think the way they 
do, they do these kinds of human studies that Dr 
Thomas has mentioned, so that they are thinking 
into the mindset. They are not relying on: “We 
comply with rule 206 in the information toolkit”, 
they are thinking themselves into the problem, and 
if there is one good thing about the delays, it is that 
we do have some time to get that right, and I would 


urge the Committee to try and press that case. 
Earlier on Dr Gillian Braunold said we have got ten 
years to go on information governance. That is the 
problem. We have only recently started going on the 
information governance programme and, looking at 
what is happening on the ground, a lot of it is still 
very embryonic. That is another reason, 
incidentally, why I have anxieties about trusting this 
guarantee, because the plans may be there but it is 
not really happening. 


Q153 Chairman: Dr Cundy, did you want to say 
something? 

Dr Cundy: The issue is that what we are talking 
about is a widely accessible distributed record, the 
Summary Care Record being available from these 
15,000 outlets—I am using the word outlets for 
them—and security mechanisms, which may or may 
not exist, which will be overridden by humans. We 
know that 90% of security breaches are from people 
employed within the organisation; so we must 
assume that there will be people who, either by error 
or with malign intent, will access records that should 
not be accessed. How do you limit that risk which 
you cannot limit because you cannot identify the 
crooks before? You can do one thing: you can alert 
the person, you can alert after the event, which is a 
bit of help, but actually the plans for access alerting 
the audit trails have been massively watered down. 
My understanding is that the most recent plans are 
that there will be no alerts from local accessing. For 
instance, in general practice, if one of my 
receptionists looked at one of these summary care 
records, under previous iterations I would have been 
sent a message saying, “Did you know that your 
receptionist looked at this patient’s record?” That 
will not be happening because it is a local detailed 
record, because it is too difficult to manage, because, 
as Mr Granger says, there are 500 million 
transactions a day, and I have difficulty enough 
dealing with 30 or 40 patients, let alone 100 million 
transactions. The way you deal with that problem, 
which you cannot stop, is you limit the exposure of 
the information that you are putting on the system, 
and that is the trade-off. The trade-off is how 
accessible is it from how many places against the risk 
of making that accessible? It would seem innately 
sensible to me that in a widely accessible system that 
you cannot really control you should have as little 
information as possible, that we have a programme 
which is rolling out something which we know what 
is going to be in it. We are actually hearing messages 
that what is going to be in it is much more than we 
ever conceived. It might actually mirror local 
detailed records. I think that is an issue that needs to 
be opened and aired, because patients should have 
the right to say, “Yes, I am prepared to put my 
records at risk, I am prepared to put my records on, 
in effect, what is a sort of plug and play technology.” 
Anyone can come in, plug in, have a look at a record 
and off they go. If that is a risk that people want, that 
is fine, but they can only make that assessment if they 
have informed consent. I think there are many trade- 
offs, there are many balances here. 
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Q154 Chairman: You will be pleased to know my 
final question is directed to Andrew and Martyn. 
Both of you have suggested that the new system 
should be independently reviewed and tested before 
further implementation. What do you think this 
would achieve? Do you not think that this would 
really delay the project even further from the alleged 
delays that we read about now? 

Dr Thomas: No, | really do not think it would delay. 
There is acommon myth that planning slows things 
down. Richard Granger this morning said it would 
be really nice to have found out what it was we were 
supposed to have been doing and plan it properly 
before we started, but it was too urgent to get the 
systems in and to get the benefits from that and so 
we just got on with it. I paraphrase him. Yet the 
consequence of that is that you have two years 
slippage, and more to come, no doubt, on the care 
record. I genuinely believe that they are hampered at 
the moment by the fact that ministers have made 
promises, that they have published commitments as 
to the roll out of a particular system, the number of 
acute trusts that would get particular systems in 
particular timescales, and that in order to really 
deliver the sorts of things that the NHS needs and to 
get the prioritisation right, somehow you have got to 
shake those things off, and that means getting away 
from the spin of how successful things are at the 
moment where typically what you get quoted are 
input statistics (“We have connected this number of 
people; there were this number of transactions”) 
rather than output, benefit statistics that actually tell 
you to what extent healthcare has improved as a 
consequence of whatever has been done, somehow 
we have to get away from that and to have a 
completely independent view as to how well the 
specification is understood; what can we do rapidly 
to make the specification of the systems that are 
going to be built really fit in with the clinical needs? 
Can we tease apart the issue of providing technical 
support for technical clinical functions within 
hospitals from transformation of the Health Service 
in managerial terms? Is it possible to separate those 
issues? If it is not, how can we get the appropriate 
level of organisational buy-in to the specification of 
the organisational transformations to make it 
feasible to build the systems that will not be 
constantly rejected? 


Q155 Chairman: That is the suggestion. It is more to 
do with human resources than the technical issues of 
the programme, or am I misreading that? I thought 
you would ask for a technical review, which is 
something I quoted to Richard Granger earlier as 
what you had asked for. 

Dr Thomas: Yes. 


Q156 Chairman: It is a technical review, including 
human resource aspects in terms of people in the 
workplace, as opposed to technology in the 
workplace? 

Dr Thomas: It must start with the requirements and 
how well-founded those requirements are and 
whether they are complete, whether they are 
contradictory. 


Q157 Chairman: How would a review achieve that, 
do you think? 

Dr Thomas: In the way that reviews always do, by 
going in and talking to people, by calling for input, 
by capturing what the programme says the 
requirements are at the moment, for example, and 
analysing them. 


Q158 Chairman: Going and talking to people up and 
down the land? 

Dr Thomas: If | was, God forbid, asked to carry out 
such a review, I would start off by looking at all the 
detailed planning documents and the internal 
reviews that have been done. We know that 
consultants have reviewed aspects of the 
programme, but those reviews are not published. We 
know that there have been gateway reviews. Those 
reviews have not been published. The department 
has refused to release either of those, even under 
Freedom of Information Act requests. I would start 
off by trying to find out what actually the current 
views of the programme are and getting a clear view 
as to what are the detailed plans, what are the 
detailed objectives. Let us do a technical review of 
those plans. How good are they as technical plans? 
Let us have a look at the risk register. Let us have a 
look at the project hazard log. Is anybody building 
a dependability case? Has anybody done a decent 
safety case for the systems? What plans have been 
made for the lifetime costs? Is there a proper 
business justification that shows that the costs 
actually are less than the benefits that are due to 
come out? If the answer to any of those questions is, 
“No”, you will have put your finger on something 
that needs to be fixed urgently. 


Q159 Chairman: Do you think that people who are 
involved in the national IT programme at the 
moment are aware and conscious of those facts, 
whether reviews have been published or not in terms 
of that? Do you think they are not capable of 
knowing that as something in their daily business, as 
it were? The programme is not without its problems. 
Are these people who are developing it not capable 
of being able to do that? 

Dr Thomas: | have reviewed a lot of large technical 
programmes over the years, and I want to stress, I 
am not asking to review this one personally, Iam not 
for a second bidding for that job, but my experience 
of carrying out those reviews is that people get 
blinded by the fact that they are too close to the 
project and they get compromised by the fact that 
they cannot stand back and admit errors. What 
typically happens is that people start redefining what 
the milestones meant, in order to claim success for 
milestones and to put off the day when they have to 
admit that things have gone wrong, and they start 
arguing about what it was they really were setting 
out to do at the beginning, so they start getting a bit 
weasely about what the specification really was, and 
the whole business justification is lost because the 
costs have changed, the specification has changed 
and the balance between what you are going to get 
and what it is going to cost you has gone wrong in 
two directions. The people on the programme are 
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not motivated to stand back and say that because 
they have got this vision, “One more heave and we 
will get there.” It takes somebody who does not have 
a stake in the programme to come in and stand back 
and say, “The reality is this, and we need to make 
appropriate changes if we are to achieve sensible 
things and sensible milestones.” 


Q160 Chairman: I wonder whether you think it 
would be an unfair comment, but I think what you 
have described there in the latter moments is more to 
do with an inquest than a review. It seems to me that, 
unless there is anything specific a review would do, 
most of the issues we have heard about in the last few 
hours here would be something that would be 
happening on probably a daily basis, I would have 
thought. Andrew, you wanted to comment. 

Mr Hawker: | did not, in fact, suggest a review, I was 
trying to be more pragmatic. I did suggest that there 
should be a test, or some testing that showed that 
you were actually operating in line with 


internationally approved information — security 
standards, and, in the end, the simplest way is to 
have people have a go at getting into it and use other 
objective measures of whether it is easy or not to get 
across the security barriers that you have laid down. 
I think that would be enormously helpful, because 
you can quote that in your guarantee. You can say, 
“Look, we have invited these various people to 
contradict the security and they have failed.” If they 
can doit, then we continue to try to refine it, we learn 
from that, but simply to draw evermore elaborate 
models, and so on, I do not think really gets us any 
further. 

Chairman: Could I apologise once again for the 
lateness of the hour. Could I thank all three of you 
for coming along. We have had two very interesting, 
fascinating sessions and I am hopeful than, when our 
report does come out, it will be a lot more informed 
because of the two evidence sessions this morning 
than it has been up to now in terms of what has been 
floating around in the media. Thank you very much 
for attending. 
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Q161 Chairman: I welcome you to the second session 
of our inquiry into the Electronic Patient Record. 
For the record, could you introduce yourselves and 
the positions you hold? 

Mr Bamford: | am Jonathan Bamford, Assistant 
Information Commissioner. Essentially, I am 
director of data protection development and am 
responsible for the work of the information 
commissioner on electronic health records. 
Professor Korff: | am Douwe Korff, professor of 
international law at London’ Metropolitan 
University. I am an expert on the European 
Convention on Human Rights and data protection. 
Iam also on the advisory council of the Foundation 
for Information Policy Research which made a 
submission to the Committee. 

Ms Robins: 1 am Joyce Robins, co-director of 
Patient Concern which is a watchdog group formed 
seven years ago because it was felt there was a need 
for a truly independent patient voice. 


Q162 Chairman: To start this session I ask a 
question of all of you. The Government plans to 
place patients’ health data on the new Summary 
Care Record without their explicit consent provided 
they do not opt out within a specific period. Is that 
opt-out approach legal? 

Professor Korff: | think that to put data on a 
particular record depends on a certain legal basis. 
With free consent almost everything is possible. If 
data from the Summary Care Record are disclosed 
to third parties consent will be needed; otherwise, it 
will be illegal under European law, unless there is 
very specific statutory regulation. 

Ms Robins: | am no lawyer. I am very concerned by 
the position in which doctors will be put because of 
this. I sit in the magistrates court. Many people who 
have been working abroad or visiting families for 
some months come back to find that court 
summonses have piled up and they have no 
knowledge of them. I believe the same will happen 
here. People will have their data put up in two 
months’ time without their consent. How doctors 
will defend themselves legally one does not know. It 
is also the responsibility of the doctor that the 
patient should be fully informed when data are used. 
In my view, patients are not being fully informed, as 
I hope to amplify later. 


Mr Bamford: Any personal information on patients 
must be held in accordance with the Data Protection 
Act. To do that there must be a proper basis for 
processing the personal data in the first place, and 
there is a provision in the Act that allows sensitive 
data, such as medical matters, to be processed where 
that is dealt with by a healthcare professional or 
somebody else who in European terms owes a 
similar duty of secrecy or, as we say in our law, a 
duty of confidentiality. On the basis that 
information is processed by a person who owes that 
duty it includes people who may be healthcare 
workers more generally, because the issue of 
confidentiality pertains to the nature of the 
information and the circumstances in which it has 
been provided rather than the nature of the person 
who processes it. Anybody in the healthcare 
professions owes a duty of confidentiality. There is a 
basis for processing it, but that gets one only to the 
starting line in terms of data protection; as a 
condition it is a precursor. Therefore, once one has 
a basis for processing data under the Data 
Protection Act one needs to make sure that it is done 
in accordance with the data protection principles. 
The first principle says that personal data must be 
processed fairly and lawfully. The issue then arises: 
is it fair for patient information to be put on a 
summary care record which will be uploaded on the 
basis of an opt out or opt in? On the basis that there 
are some competing interests here, one can argue 
that some people would want to make the judgment 
that they do not want their information to go 
forward. Many others may take the view that 
healthcare would be improved by a national care 
system and the ability to facilitate medical treatment 
in other parts of the country. If like me a person from 
the North West is on business today in London in 
relation to those sorts of things fairness can work the 
other way as well. We take the view that it is entirely 
consistent with the first data protection principle. If 
patients are informed that they can exercise a proper 
choice over what happens to their information on 
the basis of transparency, and they have the 
opportunity and time to make that choice, it is 
consistent with the requirements of the Data 
Protection Act to provide it on an opt-out basis. 


Q163 Chairman: The written submission from the 
commissioner could be interpreted as saying that the 
opt out you are talking about would not be 
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necessary under the Data Protection Act at present. 
What you are saying quite specifically is that it is. Do 
you say that effectively if the opt out, which we 
understand is to be offered—it has been offered in 
pilot schemes in some parts of the country—was not 
in place it would be illegal to set up these records? 
Mr Bamford: | think it can be argued that it may be 
unfair in connection with some personal data. 
Personal data always pertains to individuals and 
there may be some circumstances in which there is 
unfairness to individuals if they are not given the 
chance to exercise their rights in some way. I think 
we need to be careful about what we are considering 
here. We recognise that we have a _ national 
healthcare system, so the idea that it is not possible 
to retain any central records of people covered by 
that system, ie demographic data, is wrong. I think 
it is acceptable to do that. The issue is to do with the 
degree to which other information relating to patient 
care may be available to others beyond the medical 
practitioner who has the treatment of the individual. 
Looking at it in the round, with the safeguards in 
place in terms of summary care records being a 
subset of the medical records, access to which will be 
on the basis only of legitimate relationships between 
those who have some responsibility for care, except 
in the most exceptional emergencies, which will be 
audited, the provision of an opt out is a fair and legal 
way of doing it. 


Q164 Dr Stoate: Professor Korff, I have been a GP 
for a long time. The way it has always worked with 
the Lloyd George notes is that the physical record 
belongs to the Secretary of State for Health and the 
information written in that record is assumed to 
belong to the GP who writes it. Who owns the 
information on a computer? 

Professor Korff: That is a very old red herring, if I 
dare say so. The point is not the ownership of the 
data. In data protection terms you cannot own data 
as if it is some kind of goods you can sell and do with 
it as you like as the owner of a car, bicycle or 
whatever. The whole point about data protection is 
that it gives individuals rights to control the use of 
their data. Whether you say that the piece of paper 
belongs to the NHS or the GP as the guardian of the 
information on that document is in a way irrelevant 
to the question of how data protection principles 
should be applied. Those principles apply if there are 
data on you or me held somewhere. There are certain 
strict rules about how they can be used and who can 
have access to them irrespective of who owns the 
piece of paper or the computer on which the data 
are held. 


Q165 Dr Stoate: For example, patients cannot go to 
law and say that they own that data and it cannot be 
changed and nothing can be done with it because it 
belongs to them. That is not an avenue they can 
follow? 

Professor Korff: No. Primarily, data protection gives 
control over it to the subject, in this case the patient. 


Q166 Dr Stoate: A recent report from the European 
Data Protection Working Party stated that “consent 
in the case of sensitive personal data and therefore in 
an electronic health record must be ‘explicit’. Opt- 
out solutions will not meet the requirements of being 
‘explicit’.” Does that mean that Connecting for 
Health’s plans go against the law? 

Professor Korff: Here you will get an answer 
different from Mr Bamford’s. In a way, you have 
reached extremely quickly the core of the issue. In 
my opinion the Data Protection Act is in some 
respects phrased in too lax a way to meet the 
European standards. I agree with the European 
approach which is that there is a need for free and 
full informed consent for the uploading of data. One 
major difference between the Act and Directive is 
that the former gives an exemption for all medical 
purposes; it is very widely described and includes 
medical research, whereas the provision about data 
being treated by people subject to a certain 
confidentiality requirement referred to by Mr 
Bamford, which you mentioned earlier, applies 
effectively only to medical care. I read from the 
document you just mentioned: “Not covered is 
further processing which is not required for the 
direct provision of such services. Not covered is 
medical research or the subsequent reimbursement 
of cost by a sickness insurance scheme, or the pursuit 
of pecuniary claims.” That is a massive difference 
with these kinds of issues. If one uploads the 
summary care record or the more elaborate care 
records without making that distinction one is 
extremely likely to break European law. 


Q167 Dr Stoate: This is quite an important issue. 
Professor Korff: Very important. 


Q168 Dr Stoate: You are quite clear that the current 
proposals by the Secretary of State for Health would 
in your view breach European law? 

Professor Korff: Absolutely, yes. 


Q169 Dr Stoate: Mr Bamford, what do you think 
about that? 

Mr Bamford: | think we need to be careful to read 
the working party opinion on article 29 in the proper 
context. It talks through the basis for processing. 
Once you have established a basis for processing, 
what safeguards should go with it? When it talks 
about explicit consent and those sorts of matters it is 
considering the various conditions that might apply 
to whether or not there is a basis for processing 
sensitive data. It is one of those precursor elements 
to get to the starting line. It talks there about explicit 
consent as being one basis on which one can process 
sensitive data. There is another basis on which one 
can process sensitive data, that is, where it is done by 
a healthcare professional subject to duties of 
confidentiality. The UK has not chosen to go down 
the explicit consent route but to pursue the 
processing by healthcare professional route with a 
duty of confidentiality. When it talks about explicit 
consent we need to be certain whether it is talking 
about getting to the starting line or about explicit 
consent in terms of fairness which comes into play 
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once there is a basis for processing. I know that it is 
complicated, and that is why the opinion is 22 pages 
long. Basically, I am saying that in the context of 
explicit consent in the UK we have gone down a 
route that does not involve the explicit consent of the 
patient for the processing of the personal data. We 
may argue in some other instances to do with a 
processing activity involving that personal data, 
such as perhaps a release for medical research, that 
explicit consent may come back in, but the actual 
uploading of the Summary Care Record is not based 
on the explicit consent of the patient. 


Q170 Dr Stoate: But the point you have just made is 
that we have chosen a different route from the rest of 
the EU. 

Mr Bamford: We have not chosen a different route. 


Q171 Dr Stoate: We have adopted a different basis. 
Mr Bamford: | am just explaining that the article 29 
working party paper essentially covers the 
possibilities in 27 different countries. Some 
countries, for example France, have gone down the 
explicit consent route; others like Austria, as I 
understand it, have said they will pass a law that 
deals specifically with healthcare records and that is 
the route they favour. It is possible to have a specific 
healthcare records law under the EU. In the UK we 
have just used one of the other facilities that are 
available. None of these is necessarily right or 
wrong; they are just different approaches that can 
be adopted. 


Q172 Dr Stoate: It is not a matter of right or wrong, 
but when somebody decides that he does not like 
what he has and takes it to European law, as he is 
quite entitled to do, what happens then? If we have 
taken a view that is contrary to that of other 
countries in the EU many people will say that they 
have a case under European law. What then 
happens? 

Mr Bamford: To clarify the question, are you asking: 
what rights do people have if they do not like what 
has happened to their records? 


Q173 Dr Stoate: Sooner or later someone will take 
this to Europe because that is the nature of things. 
What is likely to happen if that is the case? 

Mr Bamford: \t would then be a matter for the 
European Court of Justice to decide whether or not 
the Data Protection Act provides a proper basis that 
correctly implements the EU Directive. We would 
argue that there is a correct basis under the Data 
Protection Act and that that law correctly 
implements that EU Directive. 


Q174 Dr Stoate: Professor Korff clearly does not 
agree with you. We have a problem. If we go down 
a route that affects the records of 50-odd million 
people and we are getting into problems with 
European law—we already have two experts who 
hold contrary views on it—it is not a very good basis 
to start a process. 

Mr Bamford: | do not know whether or not 
Professor Korff does disagree with me. 


Professor Korff: | do disagree. 

Mr Bamford: | think that there is a clear basis in UK 
law for doing what the Department of Health and 
Connecting for Health have decided to do here. 
Whether there is some slight differences in the 
wording between the terms of the European statutes 
and our domestic statutes is another issue. I sat on 
the article 29 working party and so I know what 
went on there. Having sat round that table, I believe 
everybody recognised that this could be achieved in 
different ways. What we are talking about are the 
different ways to achieve it, not that it is necessarily 
the wrong or unlawful way to do it but whether there 
is a more favourable or less favourable way to do it. 
We take the view that this is a lawful way to do it. I 
do not believe that the article 29 working party is 
saying anything else. 


Q175 Dr Stoate: Professor Korff, how do you view 
that reply? 

Professor Korff: First, | believe that Jonathan is 
underplaying the status of the working party 
document. It is a working document, not a final 
interpretation, but it points out a number of 
fundamental principles which are quite clear. It is 
not a matter of saying that this is just an opinion; 
some of these principles are quite clear. There are 
two main differences between the Act and the basis 
upon which the Government seeks to rely in 
introducing this new healthcare system and the 
Directive. The first is the difference that has just been 
pointed out in article 8.3 of the Directive which says 
that one can process for healthcare reasons, subject 
to confidentiality. Mr Bamford is quite right that 
that is an alternative to consent, but that provision 
in the Directive is narrower than the corresponding 
one in the Data Protection Act. Therefore, to the 
extent it is not covered by the Directive it is invalid 
and one would need consent. It looks tiny but it is 
not; it covers specifically secondary uses for research 
purposes which are authorised by the UK Act but 
not by paragraph 8.3 of the Directive. Mr Bamford 
can say that we have chosen to go that way. One 
cannot choose to do something that one is not 
allowed to do in the Directive. That is a 
straightforward contradiction between the two. 
Second, paragraph 8 of schedule 3 of the Data 
Protection Act—as you will have found out by now, 
it is a ghastly instrument to read—gives a special 
exemption. The only way that it can be brought 
within the Directive is to say that it is one of the 
special exemptions introduced in article 8.4 of the 
Directive, but it cannot be for various reasons. It is 
not specific enough; it does not specify the 
substantial public interest for which it is introduced. 
To the best of my knowledge, it has not been notified 
to the European Commission and therefore it is 
incompatible with the Directive. Again, one of the 
major planks on which the whole system is being 
built is incompatible with the underlying European 
rules. In addition, Mr Bamford mentioned the 
European Court of Justice. Quite rightly, the first 
test would be the compatibility of anything 
introduced here with the Directive. That would be 
decided in the European Court of Justice in 
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Luxembourg, which by the way in the Lindquist case 
was very precise and extensive in its application of 
these principles. I would be happy to take a case to 
the European Court of Human Rights in Strasbourg 
which has also become increasingly aware of and 
strict in the support of data protection principles. 
Therefore, to try to say that the UK has a different 
way of doing things is not good enough if that 
different way is so outside the European framework 
such as to violate the fundamental instruments of 
article 8 of the European Convention on Human 
Rights and the EU Directive. In my opinion, the 
system as now proposed violates both. 

Dr Stoate: Chairman, this is a rather fundamental 
point. We have two experts who fundamentally 
disagree before we have even started the process. 
One can imagine one might happen as things move 
along. That has certainly answered my questions. 


Q176 Chairman: Professor Korff, if as legislators we 
were to try to second-guess what would end up in the 
European Court of Human Rights we would pass 
very little legislation in this Parliament. 

Mr Bamford: Perhaps I may make one point of 
clarification in terms of other people to whom the 
Committee may wish to speak. If there is any issue 
to do with whether the UK Data Protection Act 
correctly implements the EU Data Protection 
Directive that is a matter for the Ministry of Justice, 
as it is now, because that is the body which is 
responsible for ensuring that we implement the 
Directive in UK law. If there is a concern about a 
difference it is for the Ministry of Justice to answer 
that point. The Information Commissioner is 
charged with implementing the UK Data Protection 
Act, and I can give you as many helpful answers as 
I can about the article 29 working party. I would 
beseech you to read those conditions again and see 
them listed as possible and not mutually exclusive 
alternatives, but I leave the point there. If you have 
a real concern I believe it is important that you speak 
to the Ministry of Justice as part of this inquiry. 


Q177 Mike Penning: Now that two of our experts 
have managed to reach complete disagreement on 
matters of law let us turn to ethics which I believe 
will be much more controversial. From an ethical 
standpoint, is it right that patients’ data can be 
placed on an IT system without their explicit 
consent? 

Ms Robins: It is completely wrong. When this 
scheme was launched we were enthusiastic about it 
because there are obvious benefits for patients. 
Records would be easily available and maybe we 
could see them without having to battle or grovel for 
them, but as it has gone on we have developed severe 
misgivings. We were active in the Department of 
Health’s consent initiative four years ago. Since then 
we and many other groups have worked very hard to 
try to give patients the confidence to play an active 
part in their own healthcare. The care records 
scheme with its assumed consent policy drives a tank 
through the whole thing. We are back to the old 
paternalistic idea “We’ll do what’s good for you; 
don’t you bother your confused little heads.” It 


seems to us that so far so much time and money has 
been spent on the IT problems and getting the 
clinicians on board that now there is a push to get it 
launched at all costs to prove that the money is being 
well spent and at the end of it patients are being 
short-changed. If the prime aim is to get 99% 
coverage we are flying in the face of all medical ethics 
and to do so it seems that we are relying on three 
things: inertia, lack of knowledge and fear. That is 
an extremely worrying precedent for all future 
consent and confidentiality issues. Perhaps I may 
quickly refer you to the leaflet that is going out to 
people in Bolton who are involved in the scheme 
right now. We have five pages of flimflam. The back 
page gives a helpline that can be phoned for further 
information. Right at the bottom in tiny print one 
sees: “If you want to see what’s in your Summary 
Care Record or you don’t want a Summary Care 
Record at all ask someone in your GP surgery to 
discuss it with you.” The message to patients is that 
they will be leaned on. Last time I was here terms 
such as “privacy fascists” and “Luddites” were used. 
I realise that there are careers to be made here and 
gongs to be won, but it seems to me to indicate the 
attitude that patients are likely to meet if they go 
along with any concerns. I know from my work at 
Patient Concern that any patient who rings us with 
a problem about his or her GP will say, “I can’t 
complain because I’ll be struck off the list.” This will 
be a real patient fear in this case. I know that it does 
not happen often; it is a bit like being mugged in the 
street. It does not happen often but it is a fear in 
everybody’s mind. 


Q178 Mike Penning: Professor Korff, does this fly in 
the face of medical ethics? 

Professor Korff: 1f 1 may, I think the best thing is to 
quote the Data Protection Authority’s interesting 
study in 2002 into anonymisation in the healthcare 
system. It looked at the implications of certain 
massive systems. It says one of the problems is that 
the individual human being becomes no longer a 
subject but an object, a carrier of data, a cost factor, 
a risk potential, a resource or a production factor. 
That is exactly what has happened. I think it is 
unethical to do this kind of thing without the consent 
of the data subject. 


Q179 Mike Penning: Mr Bamford, do you agree that 
it flies in the face of ethical standards? 

Mr Bamford: | would not set myself up as an expert 
on medical ethics. 


Q180 Mike Penning: What do you say as a patient? 
Mr Bamford: In terms of record-keeping and data 
protection people in general have no absolute right, 
except perhaps in the case of direct marketing, to say 
that they do not want records about them to be held. 
If there was such an absolute right I suspect that the 
police national computer would not have very many 
records on it. 


Q181 Mike Penning: There is a difference between a 
criminal and a patient. I do not see that link at all. 
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Mr Bamford: | am not making a link but explaining 
why there is no absolute right for data subjects as 
individuals to say that information should not be 
held about them. In the medical context it is not 
possible generally for individuals to say that 
information cannot be held about them unless they 
can prove they will suffer substantial unwarranted 
damage and distress. That has to be proved. There 
are good reasons for this. Presumably, a medical 
practitioner wants to keep records of the treatment 
that he has given a patient and that is usually in the 
patient’s record. A GP can be subject to action and 
he will have to defend his action perhaps in terms of 
the prescriptions he has issued. Therefore, the idea 
that a patient can say, “Don’t keep any records on 
me”, and then come back at a later point and say, 
“Y ou were negligent in the way you treated me”, and 
the doctor says he has no records and it cannot be 
proved one way or the other, is unfortunate in the 
extreme. There are balances of interest. 


Q182 Mike Penning: That is a very long answer toa 
question which, with respect, I have not asked. My 
question is to do with ethics, not whether or not 
there is a legal reason to hold records. That is a 
separate issue which I believe you addressed in 
previous answers. As a patient, from an ethical point 
of view—you cannot answer it from a medical point 
of view—is there a problem with these records being 
held on a new IT system, yes or no? 

Mr Bamford: | thought I was answering the question 
by saying I do not think there is an ethical problem 
if it is accepted that it is right for a medical 
practitioner to be able to keep a record of his 
patients. 


Q183 Mike Penning: The Government has produced 
an opt-out system. Is there an alternative to that 
system? Clearly, it is saying that one can opt out, 
though it is quite complicated. Can you think of a 
better alternative system? 

Mr Bamford: | can certainly think of alternative 
systems which would be an opt-in system where 
every patient would be asked what he or she wants 
to happen to the records before a Summary Care 
Record is uploaded. 


Q184 Mike Penning: Why is that not being used by 
the Government? 

Mr Bamford: | think the practicalities of doing that 
are huge. At the end of the day we have a national 
health system in the UK, so some elements of 
national records may be appropriate. The issue for 
us is the extent to which individuals know what is 
happening. We have been insistent with Connecting 
for Health, which originally was going to send out 
only a head-of-household mailing, that mailings 
should go to individual patients to make sure they 
are given information about the choices available to 
them and they have adequate opportunity to 
exercise those choices. I understand the comments of 
Ms Robins. From my point of view, in the 
discussions with Connecting for Health we were told 
it was important that medical practitioners help 
people make their decisions because they had to 


understand the consequences of what they were 
being told. We did not see it as an arm-twisting 
exercise; it was making sure that people had proper 
information on which to make choices that might be 
hard to convey in a leaflet. 


Q185 Mike Penning: It is quite difficult to make a 
choice if you are automatically in. Most people will 
not know. that. Professor Korff, do you see an 
alternative to the Government’s opt out? 

Professor Korff: Yes. First, perhaps I may comment 
on Mr Bamford’s remarks about the opt out. Again, 
there is a discrepancy here between the Directive and 
UK law. 


Q186 Mike Penning: That does not surprise me. 
Professor Korff: One can opt out under the Act only 
if one can show that one will suffer substantial and 
unwarranted damage and distress. That is a phrase 
that you will not find in the Directive. The equivalent 
in the Directive is that if one has a justified objection 
one’s wishes must be accommodated. If people are 
worried because they are HIV positive—I gave a 
speech to such a conference the other day—or 
because as young women they had abortions that is 
a justified objection to the data being uploaded. As 
I understand it, that is not being accommodated 
because the UK Act provides a bigger hurdle than is 
allowed under European law. It is a really serious 
problem. Mr Bamford says that the Information 
Commissioner just talks about the compatibility of 
this exercise with the Act and does not want to talk 
about the compatibility of the Act with European 
law. I find it very short-sighted. If I was the 
Information Commissioner I would take a broader 
view of my powers, but it is up to the commissioner 
to do that. By all means ask the Ministry of Justice 
or Department for Constitutional Affairs. I believe 
that if they look carefully at the law they will find 
incompatibilities that affect the very basis of what we 
are talking about here. 


Q187 Mike Penning: Ms Robins, on Friday I had a 
constituent in my surgery who for personal reasons 
did not want her previous medical records to go onto 
the IT system. Is there a better system than the 
Government’s opt out, because it sounds as though 
she will not be able to opt out? 

Ms Robins: She cannot have a Summary Care 
Record put on; certainly that has been agreed. I 
know that the Department of Health and maybe lots 
of others would like it to be mandatory, but it is not. 
We can opt out. My problem at the moment is that 
informed consent cannot be given unless a person 
knows what it is. One does not know what it is unless 
one has seen the record that is going up. It is not that 
difficult to do. I do not suggest that everyone should 
sit down with their GPs; that would be ridiculous, 
but there are other ways. As I said in my submission, 
the first thing we suggest is that when this bit of 
rubbish goes out to patients with it should go a copy 
of the record that is going to go in. Connecting for 
Health very quickly jumped on me and said that the 
postal system was not nearly secure enough for that. 
It is interesting that that is the system on which it is 
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relying to make sure everyone is informed about it, 
but never mind. If that is not secure enough why not 
send a form to people and clearly set out the options? 
You can see your record and be asked, “If you wish 
to see your record before it is uploaded tick here”; 
or, “I have been offered an opportunity to see my 
record and I do not wish to see it”, and you tick 
there; or, “I do not wish my record uploaded”, and 
you tick here. That does not seem to me to be too 
difficult or time-consuming, but we do not have that; 
we have something that deliberately discourages 
people from doing this. For instance, we are told 
that part of the record can be invisible. The patient 
in your surgery can have the sensitive bit of her 
record not showing when it comes up on the screen 
and it will be flagged up that she has not given 
consent to it being seen. When I went to the 
presentation by Connecting for Health the other 
week I was amazed to find that that can be 
overridden with the click of a mouse. A doctor can 
do it as you sit there with a click of a mouse and 
without any consent form being signed. Most 
doctors will act ethically and do it the right way. The 
patient is there and the GP says that it will be helpful 
to see it and the patient will say, “All right. I trust 
you to see it.” I have come across plenty of doctors 
who will not act ethically; they will say they have a 
difficult patient out in the waiting room who will not 
tell them everything they want to know and with a 
click of a mouse consent status is altered. I was 
appalled to see that that was the case. That is how it 
is being rolled out at the moment. Patients have no 
idea that this is going on. 


Q188 Mr Amess: I should like to congratulate our 
clerk for gathering together our witnesses. This is 
what an evidence session should be about. There is 
real tension here. I shall do my best to see if we can 
make it rowdier. This is much more interesting than 
the rubbish going on at College Green at the 
moment. Ms Robins, you argued that patients 
should be able to see what information will be put on 
the SRC system before it is uploaded. How would 
this help? Why do you think the Government is not 
adopting your proposal? 

Ms Robins: It is too much trouble. They have said it 
is not practical. I say that if it is not practical then 
the scheme is not practical. Under all the informed 
consent regulations every regulatory body says that 
there must be informed consent before doctors part 
with any information about you in any way. If that 
is how it is that is what we should be doing. 
Therefore, one has to see it. Another thing patients 
do not realise, unless they have ever had reason to 
consult their records, is the number of mistakes in 
them: 30% of doctors’ records contain mistakes. 
Once that goes up on the computer anybody who 
has dealt with computers knows what it is like. It is 
on the computer and that is it; that is fact. As it is it is 
desperately difficult to alter medical records for very 
good reasons. The most one can manage to do is 
have a little note put on the bottom saying that the 
patient does not agree with it. In the case of 
summary records it is not too sensitive and the 
information going up is very limited, but, say, the 


wrong medication happens to go up. The wrong 
code can be very easily put up. The patient is treated 
wrongly. What is then the doctor’s legal position? If 
the patient has seen it and says, “That’s not what I 
am on; I am on something that sounds very much 
like that”, then it can be altered and put right before 
it is put on. There is a lot of talk about quality 
control in Connecting for Health. That is where 
quality control comes in; you see it before it goes on 
and you make sure it is right. 


Q189 Mr Amess: Mr Bamford, what Ms Robins says 
seems to be commonsense. Why do you disagree 
with her proposal? 

Mr Bamford: | do not want to disappoint you by not 
arguing with my colleagues, but I agree with a lot of 
what has been said about the importance of data 
quality. If you read our evidence you will see that we 
stress the importance of data quality. One of the 
features in which we are interested is HealthSpace 
and the idea that one is able to check the quality of 
one’s own records, the security arrangements 
around that and we need to understand how those 
work. But the idea that individuals should be able to 
see their health records and if they spot a 
discrepancy or concern voice them is entirely 
consistent with the requirements of the Data 
Protection Act. I do not have a problem with that. 
One of the ideas about going to see the GP to talk 
about concerns is that that is another opportunity to 
discuss the information that will be loaded and 
ensure that it is of the appropriate quality. I agree 
wholeheartedly that we need to ensure that if 
information is being put on a system and people 
believe what computers say it must be of the 
appropriate quality, but that is not just for the 
virtuous; it is a requirement of the Data Protection 
Act. It must be adequate for its purpose and it must 
be accurate information. 


Q190 Mr Amess: Ms Robins, do you really think 
that Mr Bamford is agreeing with you as he claimed 
at the start? It does not sound like it to me. 

Ms Robins: Not at all. Once it is on HealthSpace it 
is there; it is uploaded and is a fait accompli. We have 
all seen what happens with websites recently with 
junior doctors. A lot of patients will wake up to the 
fact that websites are never secure; whatever you put 
in place hackers will get in. We had expected some 
system of smart cards for patients. That was talked 
about originally. One would go into a secure 
environment and see it in a secure system, but there 
is no mention of that any more; it seems to have 
gone. We now have HealthSpace. The summary 
records will go on that; there is no plan for the 
detailed record to go on it. How we get to see that is 
a question mark for the future. 


Q191 Mr Amess: Patients will be able to view their 
Summary Care Record on the HealthSpace website. 
Surely, this will allow patients to play a more active 
role in their own care. When do you expect 
HealthSpace to be available? 
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Ms Robins: | do not know when it will be available; 
it certainly is not available to people in Bolton at the 
moment. Their records will go up and they have no 
way of seeing it, unless they go along to their 
doctors’ surgeries. There are a lot of problems about 
that. People feel that they will be leaned on, and 
many do not wish to go to their doctors’ surgeries. 
Incidentally, when we rang the helpline to ask 
whether we could simply write to say we do not want 
our records to go up we were told that letters were 
not accepted; we had to make an appointment and 
go to the surgery. What about people who have great 
difficulty getting to the surgery? The response was, 
“Well, we’re very sorry; we’re not accepting letters. 
Somehow they have to get there.” It is not good 
enough. 


Q192 Mr Amess: Does either of the other two 
witnesses want to come back on what Ms Robins has 
just said? 

Professor Korff: 1 make only one point since 
reference was made to sealed envelopes. It is so 
important that I do not want to let it pass without 
a response. In the working party document that the 
European Data Protection Commissioners have put 
together there is also reference to sealed envelopes. 
It has one enormous difference from the sealed 
envelopes as proposed here. It says: “A sealed 
envelope should only be openable for each 
individual instance when a health practitioner wants 
access to it by the consent of the patient.” Therefore, 
it is not something that can be overridden by 
anybody except the patient. If a healthcare 
practitioner wants access to something in the sealed 
envelope he has to come to me and ask me. Unless I 
am in a coma or in an accident and emergency ward 
he will have to ask me and it can be disclosed only if 
I agree to authorise it, not just generally which is 
what is proposed for the system, in that specific 
instance and for that specific treatment. That should 
be the rule, not that you sign your rights away as 
soon as the envelope is unsealed. 


Q193 Mr Amess: Do you agree with your colleagues? 
Mr Bamford: | do not see myself in massive conflict 
with that. I agree that patient information should be 
accurate. There is no doubt that the Data Protection 
Act requires that it be accurate. The next question is: 
what is the best method of achieving it? 


Q194 Mr Amess: What else do you think can be done 
to give patients more control over their electronic 
records? Presumably, you do not think they need 
any more control. 

Mr Bamford: | think that as to the mechanisms being 
set up the proof of the pudding is in the eating, is it 
not? At the moment we have certain things on pieces 
of paper which are ideas from the point of view of the 
Information Commissioner. Some of those are 
plausible, but it is a matter of how it works in 
practice. One of the things that we are interested in 
is how the early adopter sites are working. We have 
agreements in place with Connecting for Health to 
be able to go in and inspect one of the early adopter 
sites to see how certain things have worked in 


accordance with the Data Protection Act. There are 
opportunities there for us to look at that, at how the 
patient leaflet is working and the idea of section 10 
notices being a way to opt out. All those sorts of 
things are open to further deliberation based on the 
lessons learned from the early adopter sites. I am 
keen that we use those sorts of opportunities to learn 
and make sure we go forward with something that is 
robust and delivers the safeguards that are meant to 
be in place. 


Q195 Mr Amess: Mr Bamford, I think your real 
forte is to be on the working party on the European 
Directive. Can either of the other two witnesses shed 
any light on what further can be done to give more 
control? 

Professor Korff: The most fundamental control is for 
an individual to be able to say he or she does not 
want the data to be on the record at all. No real 
provision is made for that. I think that the people 
who are putting together the system hope that only 
0.01% will opt out and therefore there will not be a 
real problem. If patients really become aware of 
what is happening, especially the secondary uses that 
are regularly allowed, I believe that a much higher 
proportion will opt out and in that case provision 
should be made for alternative arrangements. Let 
me again read the words of the working party: “Any 
consent given under the threat of non-treatment or 
lower quality treatment in a medical situation 
cannot be considered as free consent. Consent given 
by a data subject who has not had the opportunity 
to make a genuine choice, or has been presented with 
a fait accompli, cannot be considered valid.” Those 
are not the speculative ramblings of the working 
party. My colleague sits on it, so I would not say that 
it ever rambles, but that is a proper statement of 
European law. Try to bypass that and the alternative 
is not to rely on consent. In that case you either rely 
on these two flimsy provisions in the Act, which are 
contrary to the Directive, or you adopt a specific 
measure as they do in Austria. I can guarantee that 
that measure in Austria, or the similar one in 
Germany, is much more specific and detailed and 
has much fuller safeguards than are envisaged here: 
for instance, provisions about sealed envelopes that 
cannot be opened without the consent of the data 
subject; and the right of every patient regularly to 
receive a log of every person in the NHS who has had 
access to his data, including, I daresay, any 
researcher who has access to his data and who can 
be identified. Those are safeguards that can be built 
in; they are not envisaged here now. If you want to 
adopt a new statute on this system by all means do 
so, but go and study the countries that have a longer 
history of serious data protection like Austria and 
Germany which have constitutional provisions that 
make serious attempts at what is called the 
minimalisation and proper anonymisation of data 
for longitudinal research studies which are much 
stricter than are imposed here by the authorities that 
supervise studies in the UK. There can be much 
tighter control which I cannot deal with here in five 
minutes. Many more safeguards can be built in that 
are not being built in. In addition, the focus should 
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always be the patient. The first purpose of the system 
should be the care of the patient; helping civil 
servants, managers and researchers are secondary 
thoughts. They should be allowed to the extent that 
they do not impinge on patient rights; patient rights 
should not be pushed aside in order to make things 
easier for managers and researchers. 


Q196 Mr Amess: I do not give him an opportunity 
but I sense that Mr Bamford will agree with 
everything you have just said. 

Ms Robins: | expect the result of the adopter sites 
will be that 0.01% of people are concerned. I know 
that because that is the way it has stacked up. It is 
being done basically as a marketing exercise. People 
are not being properly informed and therefore that 
is what I expect to happen. People are not being told 
any of the detail and so they will not be hammering 
for information. The whole problem with patients is 
that they do not know what they do not know. If 
they are not told they may well never know. I recall 
that at the previous session Sandra Gidley said that 
in that part of Hampshire where she lived the scheme 
had been rolled out and she had not been fully 
informed. The answer that came back, which was a 
load of rubbish, was that they did not send it to every 
single person, for example 16 year-olds living away 
from home. With all respect to Ms Gidley, I doubt 
that she was a 16 year-old living away from home. 
Patients do not understand that the bit about the 
invisible business can be overridden; they do not 
know who will have access. Nobody knows. There is 
talk of NHS Direct and local pharmacists having 
access and being able to change it. In 2003 there was 
supposed to be consultation on that but it never 
happened. It should have happened before anything 
was rolled out so that people know just who will go 
not just into their records but their ex-directory 
phone numbers. We may go on to detailed records 
later, but when and how the historical data are 
added is absolutely crucial. You can bet that that 
will not be done by doctors sitting down with 
patients. If you had an abortion before you were 
married or made a suicide attempt 10 years ago will 
all of that be there? Before we know this sort of thing 
how can we sign up to it? We are jumping into a void. 
Mr Amess: Thank you very much indeed. I can tell 
you that again Mr Bamford has agreed with 
everything you have just said. 


Q197 Dr Taylor: Just before I move to the Detailed 
Care Record I want to refer to some fairly strong 
sentences in Professor Korff’s written evidence. In 
Evidence 64 under “The electronic patient record 
architecture” you say: “Unfortunately, the idea that 
everyone should have a single EPR, to be opened in 
the IVF clinic and archived on autopsy, was adopted 
in the 1990s as the vision for the NHS Information 
Management and Technology Strategy. NHS 
computing strategists have clung to this vision even 
as the rest of the world has moved on. The vision 
must be abandoned.” Can you expand on that? 

Professor Korff: | do not have the exact paragraph 
before me but I remember it. I did not write that 
paragraph but I still subscribe to it. The problem lies 


with the centralisation of the records and the fact 
that we should have one central record controlled by 
the NHS rather than dispersed records controlled by 
those people who treat you with the ability of those 
to interact where necessary. That is the fundamental 
difference in vision. The view of the Foundation for 
Information Policy Research is that the vision that 
should be abandoned is that of a central system 
rather than a dispersed one where the different parts 
can talk to one another where necessary. 


Q198 Dr Taylor: Let us explore the Detailed Care 
Record a little. I think that most of us really do not 
know what it is. I am not sure that the people who 
are designing it know what it is. At the moment there 
are separate clinical record systems in most hospitals 
for different departments. Is their idea just to link 
them together and open them up to the whole of the 
NHS, or is the DCR something designed from 
scratch? 

Professor Korff: The centralised system is designed 
from scratch. 


Q199 Dr Taylor: But that will be an amalgamation 
of all these local systems? 

Professor Korff: It is not an amalgamation; it will 
suck all of it in, if ] understand it rightly. 


Q200 Dr Taylor: We will all be there. How feasible 
is that? 

Professor Korff: You should really be talking to the 
computer engineers. There is a good catchphrase 
here. If you look at the bottom of page 65, it quotes 
Professor Anderson: “It is a principle of security 
engineering that we can build systems with 
functionality, scale or security, or indeed any two of 
these attributes, but not all three. Secure and highly 
functional systems have to be local or 
compartmentalised; they cannot be all in one system 
or you will lose either functionality or security.”! 


Q201 Dr Taylor: Therefore, security will be 
particularly at risk with something as large as this? 
Professor Korff: Absolutely. 


Q202 Dr Taylor: How have existing doctors been 
brought in to design these records? Again, you say in 
your evidence that it is only if systems have really 
been designed by the doctors who will employ them 
that they will be really dedicated to using them. The 
impression I get is that there really has not been 
much consultation on the design of what goes into 
these. Would you comment on that? 

Professor Korff: That is the idea I have, but you 
would be better off talking to the general 
practitioners. The whole concept is driven by a 
centralising idea rather than by how one can best 
serve first the patient and then the people in the front 
line, that is, the GPs and specific consultants, all of 
whom now have their own system and are quite 
happy with it. Why do we not let those systems 
interoperate rather than throw them out of the 


window and come up with a newly-designed system 
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which has all kinds of negative impacts, including 
impacts on its usability and control by the people in 
the front line? 


Q203 Dr Taylor: The Summary Care Record seems 
to be growing by small degrees and makes consent 
even more difficult. Do you have to consent to every 
bit that is added to it? I believe it was Ms Robins who 
said that one could not give informed consent if one 
did not know what would be there. As nobody seems 
to know what will be in the Detailed Care Record it 
is impossible to get consent. 

Ms Robins: | went to the CFH presentation the other 
week. It has no idea how it will do the Detailed Care 
Records. It does not know what if anything will be 
added. We know that hospital tests—x-rays, blood 
tests and so on—will go on automatically. We have 
no say in that; we cannot opt out of that, but how 
will it do the detail of what has happened to an 
individual in the past? I do not know how any record 
is of any use without detailed knowledge of what 
happened in the past. It seems to me that every 
patient will need a printout of what is going on. No 
doubt at the time we shall be told that that is not 
practical either and therefore we shall end up with no 
opt-out system from the Detailed Care Record. 


Q204 Dr Taylor: Are the patients with whom you 
come into contact particularly worried about mental 
and sexual health issues? 

Ms Robins: Mental and sexual health, terminations 
and anything of that type are usually matters that 
people do not want spread around by anybody who 
happens to look at them. There are so many 
problems. Smart cards have been passed round 
between people in hospitals recently. People who 
work in hospitals tell me that computers are 
routinely left open for anyone to see. For instance, if 
there is a celebrity in the hospital—it could be an 
MP—plenty of people can come and have a look at 
that. There will be far more of this going on because 
it is so general and it will be spread so far. 


Q205 Dr Taylor: If and when the planning is made 
for the consent systems for the Detailed Care Record 
will there be a possibility of having a group of items 
for which you do not need consent and a group of 
items for which you do? Is there any way forward 
like that? Can you see how they can plan for consent 
for a Detailed Care Record? 

Professor Korff: | do not see how technically you can 
do it. In our submission we make reference to trying 
to make prescription data a lower level category 
than, say, HIV status, but since prescription for 
AZT reveals the HIV status one cannot really do 
that. It is virtually impossible to make those kinds of 
distinctions in a sensible way. 


Q206 Mr Jackson: I should like to talk about 
children’s health. Providers of children’s services 
have argued that there should be no choice about 
whether children’s detailed health records are stored 
electronically. Do you agree with that? 


Professor Korff: | think it is appalling, quite frankly. 
First, I suppose that children are defined as people 
under 18. It is now fairly well recognised that people 
aged 16 should effectively be treated as adults. In a 
recent study we did for the Information 
Commissioner on children’s databases we addressed 
the issue of consent by minors in some detail. Within 
the NHS and beyond that the Civil Service there is a 
tendency to try to get consent from children as 
young as 12 without involving their parents. We 
have pointed out with reference to the Gillick 
decision and others that the proper way to deal with 
young children over 12, if you like those who are 
beginning to become adults, is to involve both them 
and especially their parents in every instance in 
which there is no conflict between them, which 
would be 95% of cases. If there is a conflict between 
what the child wants and what the parents want one 
has to come up with a kind of Gillick resolution. Is 
the child sufficiently adult and that sort of stuff? But 
the Civil Service attitude seems to be to override that 
and basically try to get consent for a 12, 13 or 14 
year-old in the light of rather meagre information 
and then say that they have consent and that is it. 
Another problem we have identified—I do not know 
how it will be resolved—is that parents give consent 
when a child is three, eight or 10 and is a leukaemia 
patient and that individual lives to be 23 or 25 and 
does not like it and wants to withdraw the consent 
given by the parents. Can one have the data 
extracted? Can one block a certain volume of data? 
Researchers say that that will ruin their research. 
That has not been addressed and I would have 
thought it is a pretty serious issue. 

Ms Robins: | do not disagree with that. It is a 
minefield. I have not put my mind to this before, but 
certainly all the rules of informed consent say that if 
a child is old enough to understand what is going on 
he or she can give consent. How that is applied to 
data like this goodness only knows. 

Mr Bamford: The Data Protection Act makes no 
distinction between individuals based on age; the 
rights are there for all of us. Clearly, our ability to 
exercise the rights when we are children is a matter 
for our parents on our behalf, which is what we are 
talking about here. The idea that children’s 
information is just uploaded automatically but adult 
information is treated differently is wrong. The same 
data protection rights are vested in individuals, so 
the parents would have to be consulted before the 
children had the intellectual capacity to make 
decisions for themselves. There is no difference 
between us. 


Q207 Mr Jackson: What is your ideological view on 
compulsion? 

Mr Bamford: \t should be on the basis that the 
parent of a child without intellectual capability 
should make the decision about whether or not the 
data are uploaded onto a Summary Care Record, 
just as if it was an adult making that decision. It 
would just be done on behalf of the child that is not 
capable of making that decision. It should not be an 
automatic upload. 
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Q208 Mr Jackson: Do you agree that a number of 
vulnerable patients would in general be more likely 
to opt out of having data on the system? If so, how 
do we get round that particular issue? 

Ms Robins: The recommendation for the opt-out 
system by the task force was based on that because 
with an opt-in system all these vulnerable patients 
would be left out in some way. I think that the system 
we now have discriminates strongly against such 
vulnerable people. They will not know what is going 
on and their information will simply be uploaded 
willy-nilly. That is not right. If as I suggested there 
was some sort of form whereby one had to choose 
which option to take then if somebody was not 
competent normally the person who would take 
decisions for that individual will do it. But a lot of 
elderly people who may not be fit to hoof down to 
their doctors’ surgeries and argue the question will 
want to know what is going on and what is on their 
record. Under this system they will not know 
because they will have one of these pamphlets which 
says that everything is for the best in the best of all 
possible worlds. It comes along with a letter from the 
doctor’s surgery saying that the doctor is very keen 
on this. What will the elderly and vulnerable people 
do? They will just be swept along, and I believe this 
is the wrong way to go. 

Professor Korff: | really cannot claim much expertise 
on how to treat data on vulnerable people, apart 
from basically agreeing with Ms Robins. It would 
normally be the legal guardian. What I would say is 
that you need to be particularly careful in dealing 
with data on people who are not in a position 
properly and voluntarily to give it themselves. If 
anything, you should take the most restrictive 
approach possible rather than say that you can 
override it because the individual has Alzheimer’s 
disease anyway. I think it should be the opposite: 
because a person cannot give consent we must be 
extremely careful not to assume that we can 
therefore give it on the individual’s behalf. 

Mr Bamford: If certain vulnerable groups have 
different needs in terms of information that should 
be provided in a way that ensures there is equal 
transparency for them as for anybody else and an 
equal opportunity to exercise their judgments on 
whether or not they want their records to be 
uploaded. I think it would be appropriate to have 
different mechanisms in place to allow those who 
may have difficulties to exercise the choices with 
which they are provided. 


Q209 Mr Jackson: Ms Robins seems to be going 
against the received wisdom that vulnerable people 
will opt out. You say that vulnerable people will not 
opt out, if I understand what you say. The articulate 
middle class will seek to opt out because they can 
and those who are not in that position and 
vulnerable will not do so. 

Ms Robins: The task force thought that because 
people were elderly, vulnerable or whatever if there 
was any sort of opt-in system they would not be 
opting in because they would not know what was 
going on. I say that is not so. This is a system that 
leaves them out. It will be assumed that you will be 


swept into it after eight weeks if you have not gone 
along to your doctor to discuss it. That leaves them 
out completely. 


Q210 Sandra Gidley: Perhaps we can rewind slightly 
and return to the children’s aspect. It is not really 
about Gillick competence as such. To be fair to the 
royal college and others who raised concerns, their 
point was that if a child was vulnerable or perhaps 
being abused then parents would find it much easier 
to hide it if they could opt out on behalf of the child. 
Looking at it from a wider child protection angle, 
does that perspective change your view? 

Professor Korff: | really do not see why technology 
comes in here. If there are child protection issues 
they should be identified by any practitioner. 


Q211 Sandra Gidley; One might not be able to 
identify them quite so easily. 

Professor Korff: | think that one of the stories that 
goes round is that the computer will identify children 
at risk, and I find that a problem in itself. 


Q212 Sandra Gidley: No; it is about information- 
sharing and is to do with cases such as Climbie. 
Professor Korff: Exactly. The point about Climbie 
was not that the data was not there but that the 
people misinterpreted it. It was not a matter of the 
information not being shared. That is how the Civil 
Service want to portray it because in that case they 
can make a case for more data-sharing, but that was 
not the problem in the Climbie case. I hope you have 
seen the report that we have done on the children’s 
databases which was commissioned and welcomed 
by the Information Commissioner. We go into that 
in great detail and explain why the idea that the 
computer is better at predicting who will be at risk 
than health and social work professionals is a myth 
and wrong. These decisions should be taken by 
people who have direct access and treat the child and 
know the family. They are the ones to say they think 
there is a problem with the child and they will 
consult another specialist. In the field of child 
protection when that term is properly used, meaning 
protection from direct harm, there is no problem 
whatsoever about data-sharing and it has nothing to 
do with this NHS system. When one talks about 
predicting whether children will grow up to reach 
their full potential and eat enough fruit and 
vegetables that is a totally different thing. If I may 
say so, I do not believe that your point is directly 
relevant. 


Q213 Sandra Gidley: Therefore, you emphatically 
disagree with the Royal College of Paediatrics and 
Child Health and the British Association for 
Community Child Health? 

Professor Korff: If they say that they need this 
system in order to protect children from harm I 
think they are wrong. 

Mr Bamford: The argument has never been made to 
the Information Commissioner that there should be 
an automatic upload because, as I understand it, 
parents might act in a way which could mask abuse 
of the children or whatever. If that argument is made 
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we go back to the point about what is fair in terms 
of fair processing. Yes, there are the interests of the 
individual but there can be other interests as well. If 
a persuasive argument were made that there was 
some counterbalancing interest which meant an 
individual should not really exercise a choice that 
would be something we could take into account, but 
I do not really know the full weight of the argument. 
I can see it being a plausible argument and 
something that can be looked at. There could 
possibly be a different approach based on what is 
fair, because clearly the interests of the individual 
who is likely to be abused are different from allowing 
the parents to make a decision for that person. 
Professor Korff: There is a difference between 
uploading to the spine and sharing data. The two 
should really be kept separate. If there is a child 
protection issue any healthcare or social work 
professional in touch with the child is entitled to 
share that data with any other relevant professional. 
There is no problem about that under either 
European or UK law or any ethical issue in that 
regard. Therefore, they can share the data in the 
individual case. Whether you can upload it and 
share a multitude of cases in all kinds of 
circumstances is a totally different question. I believe 
that two things are being confused perhaps because 
of an agenda. The two are totally separate. 


Q214 Chairman: Are you saying that parents should 
not have the ability to opt children’s records out of 
a Detailed Care Record? 

Professor Korff: Quite the opposite; they should. 
There might just be a GP who says he finds it odd 
that they choose to opt out in a particular instance, 
maybe because they want to hide the bruises suffered 
by the child. In that case one should immediately 
contact the relevant child protection agencies and do 
something about, but the idea that leaving data on 
children out of the spine means they will be less 
protected from abuse is not correct. 


Q215 Chairman: We are not talking about the spine 
but the Detailed Care Record. If the Detailed Care 
Record becomes our current Lloyd George record, 
as I have in my doctor’s surgery, do you say that 
somebody on behalf of children who are on the at- 
risk register should be able to opt them out of having 
their records kept electronically? Do you say that 
currently they should not be kept in a GP’s surgery 
electronically? Ms Robins, what is your view on 
these matters? We are not talking about the elderly. 
You are quite right in what has been said about it. 
But what do you say to the Royal College of 
Paediatricians in relation to the question of whether 
a person can opt out somebody on the at-risk 
register from the system? 

Ms Robins: | do not think that any of us has a 
promise that we can opt out of the Detailed Care 
Record, as far as | know. So far we have had a 
proper look only at the Summary Care Record, but 
that does not really address the question. Professor 
Korff’s point is that if a parent is trying to opt out a 
child that may very well be the exact trigger which 
will tell all the other people who deal with the child 


that there is something going on here. Maybe that 
would be useful. Who knows? I am no expert in this 
field, but from my work in the family court it was 
never my impression that child abuse went 
unrecognised because the data was not passed 
round; it arose because people did not do their jobs. 
The person who was supposed to arrive on the 
doorstep to see the child did not do it. 


Q216 Sandra Gidley: What about Munchausen by 
proxy and that sort of situation? Quite often there is 
a record of people moving round the country. 

Ms Robins: That is true. 

Professor Korff: 1 am sure you can comment that 
there is a special case which does not require a 
fundamental change of the architecture and a move 
to a massive system like this. There could be cases in 
which people who travel round the country and 
abuse children in different areas would make it 
difficult for information on their ill-treatment of 
those children to become known to different people. 
At some stage however they will become known. By 
the time a child ends up in a hospital the hospital will 
ask for the records from the previous GP and at 
some stage somebody will light it up. I do not agree 
with the idea that having this electronically on a 
central system will make it that much better in these 
extremely rare cases. 

Ms Robins: Things like x-rays and blood tests will be 
automatically uploaded. We do not have any choice 
to opt out of that. That is often the case with 
Munchausen by proxy and that information will be 
there. If you go from hospital to hospital all of that 
will be on the record. 


Q217 Chairman: | am not sure that it is technically 
feasible to put x-rays as electronic images on the 
Summary Care Record. 

Ms Robins: | thought we were talking about the 
Detailed Care Record. We are told by the 
Department of Health in writing that those will be 
automatically uploaded; we have no choice. 
Chairman: | think we shall move on from this, but we 
shall look in further detail at the issue brought up in 
the past few minutes in terms of the rights of people 
to opt out of the system others who may be in a 
vulnerable position. 


Q218 Charlotte Atkins: Professor Korff and Ms 
Robins, both of you have raised issues about the 
protection of sensitive information. Connecting for 
Health proposes to make sealed envelopes available 
to protect particularly sensitive data. Ms Robins, 
you have already raised concerns about how that 
can be overridden. Is this the way forward or is there 
an alternative way forward to be able to protect 
sensitive information such as sexual and mental 
health records? What would you propose? 

Professor Korff: Basically, there are two questions 
here: first, there is the technology of the sealed 
envelope. As I understand it, the technology has not 
been properly developed. I would not buy a car if the 
engineer told me he was still working on the brakes 
but by the time I was a few miles away he would 
probably have sorted it out. Second, to the extent 
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they have thought about it these envelopes are not 
sealed very well. It is fairly easy for health 
practitioners to break them open. When the 
European working group talks about sealed 
envelopes they mean a properly sealed envelope 
which means they have to go back to me to ask 
whether I want it opened for a particular instance by 
a particular healthcare professional. That is quite 
different from a sealed envelope. One has to be very 
careful about terminology and exactly what will be 
used. As currently envisaged, I really do not believe 
it is very useful. In particular, all the data in the 
sealed envelope as I understand it will be available 
for research with minimal anonymisation and 
pseudonymisation. We will have to go back to that. 


Q219 Charlotte Atkins: By “minimal” you mean 
things like post codes? 

Professor Korff: It is insufficient. I was hoping that 
a question on anonymisation and pseudonymisation 
would come up. I can go into it now or wait for the 
question to arise. 


Q220 Charlotte Atkins: That question will come up 
later. Ms Robins, what do you say? 

Ms Robins: | agree that if we have a sealed envelope 
that is the way it should work. As the proposal is at 
the moment, you put your sensitive information in a 
sealed envelope and you may as well put a nice red 
arrow saying that that is the information that the 
person wants to see. There is no undertaking that we 
will be notified if that sealed envelope is opened. Iam 
not however lying awake at night worrying about 
sealed envelopes because I do not think they will ever 
happen. At the previous session Richard Granger in 
his many comments said that come the day they 
would have to look at whether enough people 
wanted them to justify the cost. Come the day, they 
will decide that not enough people want them to 
justify the cost. 


Q221 Charlotte Atkins: Mr Bamford, as I 
understand it the Information Commissioner 
supports the concept of sealed envelopes. How do 
you address the concerns raised by Professor Korff 
and Ms Robins, namely that the technology does not 
exist and therefore it may never happen? 

Mr Bamford: | think the important point in your 
question is that we support the concept of it. The real 
concern for us as well is how it is delivered in 
practice. The concept that you might be able to lock 
down some personal information from the view of 
others is a privacy-friendly approach and clearly is a 
good thing. It could happen in all different forms of 
record-keeping, and here it seems entirely 
appropriate. How that works in practice as 
graphically described by my colleagues is yet to be 
determined. We are concerned about how that 
works in practice, for example how the seals are 
broken and in what circumstances. Is it just on the 
basis of consent, or is it done in some overriding 
clearly defined emergency? If it does happen like that 
what mechanisms are in place to audit that access to 
make sure it is done on a legitimate basis where there 
is a real need? One would probably argue for a 100% 


audit in those instances. Is there a need for patients 
to be told that the seal has been broken and that 
information has been revealed to somebody? Those 
can be safeguards that underpin the system and we 
would be interested in ascertaining how those work. 


Q222 Charlotte Atkins: In the meantime do we have 
to have blind faith in the computer nerds coming up 
with a system which will actually work? Is that a 
good basis on which to proceed? 

Mr Bamford: | certainly do not share that blind faith 
argument. We should be very careful about the level 
of information that goes forward. At the moment, 
with the Summary Care Record there is 
comparatively limited information available and 
therefore it tempers a little bit the element about 
what potentially may appear there and what may go 
into a sealed envelope because of its limitations. I 
think it important that the issue of sealed envelopes 
is addressed and we find out as soon as possible that 
the safeguards are robust and effective ones. 


Q223 Charlotte Atkins: But is it right to build a 
system which depends on a technology that we do 
not yet have? Given that we have not yet got the 
technology and that there is usually a way of 
cracking into a new technology a few months or 
years later, is it right to build a system where we 
cannot be sure that we can keep that sensitive 
information secure? 

Mr Bamford: \t would be wrong for a system to go 
fully live without that functionality being in place. 


Q224 Charlotte Atkins: Apart from the 
technological approach of the sealed envelope—we 
do not know whether it will ever happen or it will be 
secure enough—what can be done to ensure that 
highly sensitive patient information is protected? 

Mr Bamford: Data protection law requires that 
appropriate security precautions are taken and the 
propriety of those precautions is judged on the harm 
that an individual can suffer. The sensitivity of the 
information goes into that sort of equation about 
harm and the level of security having to go up. We 
are concerned and have said to Connecting for 
Health that there needs to be the highest levels of 
security to make sure there are no abuses of the 
system. It is not just the issue of the technical 
controls; it is the human elements of it. I believe there 
have been some graphic examples where perhaps 
security precautions have been circumvented by 
people logging on for a whole shift, using one card 
rather than their own cards. That must be stamped 
Out; there cannot be any of that. We are also 
concerned about a practice called information 
blagging which essentially means that organisations 
try to find out information about people, often using 
public sector databases. We have asked for a 
strengthening of the penalties for the offence of 
unauthorised access to information under the Data 
Protection Act. The Ministry of Justice has said that 
it will attach a criminal penalty to it, which is good, 
and Connecting for Health supported us on that. 
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But it is no good just having a hard sanction in the 
Act; we need to make sure that everybody is well 
educated in the health area. As we have blocked off 
areas that are to do with National Insurance records 
there is a chance that if we have more centralised 
health records they will become the target for 
information blaggers, because that is a way of 
finding out somebody’s name and address and not 
necessarily all the detailed records behind it. We are 
also working with Connecting for Health to do a 
research project to try to tease out where the 
vulnerabilities are in this. There is no doubt that 
there needs to be a high level of security in place; it 
is not an option. 


Q225 Charlotte Atkins: Clearly, the vulnerabilities 
have a lot to do with technology. At what point 
should the plug be pulled on the system if we are not 
satisfied (a) that the sealed envelope system is up and 
running and (b), if it is, that it has been up and 
running long enough for us to get the complex 
technological glitches out of the system so it will not 
be easily accessed by someone who wants to hack 
into the system? 

Mr Bamford: But the system cannot be implemented 
properly unless it is legal in data protection terms, so 
there must be the appropriate level of security to 
safeguard against unauthorised access. It cannot be 
implemented without that protection in place. 
Professor Korff: In my opinion you will never reach 
that level of security. The people I work with in the 
Foundation for Information Policy Research tell me 
that technically for a system as large as this you will 
not get the level of security that you need to protect 
people’s medical data. The only way is to give up on 
the centralised concept and go back to a dispersed 
interconnected system. The simple answer is that it 
is just impossible; you will never be able to get the 
level of security that I and Jonathan in his heart of 
hearts also thinks is required to protect medical data 
in a massive system like this. 


Q226 Charlotte Atkins: Your response to that is to 
pull the plug now? 

Professor Korff: Yes; you have to start with a new 
system. Do not put it all on a centralised system on 
this scale because you will not be able to implement 
the appropriate security levels. 


Q227 Chairman: I want to move on to the secondary 
uses service. Our understanding is that this will make 
electronic data available for such uses as research, 
audit and commissioning. This seems to be the focal 
point for patients’ concerns about confidentiality. 
First, why is that? What can be done to improve the 
privacy arrangements for the secondary uses service? 
Ms Robins: | am not sure that it is the main focus of 
patients’ concerns, because most patients have no 
idea that it goes on. Before I started to research this 
and read the submissions I had no idea of the extent 
to which it went on and where my data was sent and 
how easily I could be identified. I do not think that 
most patients to this day know that, and they are 
certainly not being warned at the moment. 


Q228 Chairman: If your record, either the detail or 
a summary, is available, let us say, wider than your 
current record and by implication somebody else is 
using it that is a concern to you. I would have 
thought it was a fundamental in this debate. 

Ms Robins: | am saying that most patients have no 
idea that this is happening. It seems to me that a lot 
of the time anonymisation means your name is not 
there but your full postcode and date of birth are 
there. I live in a street of 12 houses. If you have my 
postcode and date of birth you know who I am. It 
seems to me that the only reason for doing it this way 
is so people can be re-identified. I gather from the 
submissions that this has happened quite frequently. 
Again, patients have no idea that that happens. It 
will be terrifyingly easy to access information when 
the system goes on. I imagine that requests for access 
will proliferate and it will be extremely difficult to 
resist those. It should not happen. 


Q229 Chairman: You do not think this should 
happen at all, or can we protect privacy better than 
the system that we understand it will be at the 
moment? 

Ms Robins: Obviously, I accept that data must be 
used for research but it must be _ properly 
anonymised. I would have thought that the area and 
birth year would suffice. That shows clusters in this 
or that area of the country or things that have 
happened in a particular age range. That should be 
sufficient; otherwise, consent should be sought. 


Q230 Chairman: We will have a look at the actual 
keys involved, but presumably in principle you do 
not disagree with the secondary uses service in terms 
of audit, planning and whatever comes of it. Is there 
a risk that the use of data by secondary users will end 
up in the European courts? From earlier responses 
perhaps you will say yes in response to that. 

Professor Korff: | will say yes, and perhaps Jonathan 
will be more modest in his answer. The issue hinges 
on identifiability. When the data used in research or 
planning management whatever are so flimsily 
anonymised that it is very easy to re-identify people 
in my view they remain personal data and therefore 
cannot be used without the express, valid and free 
consent of the data subject. Only totally anonymised 
data or very seriously pseudonymised data can ever 
be passed on without with the consent of the 
individual. In many studies the level of security 
against re-identification is not sufficient. On top of 
that there will be a demand for the use of this data 
in identifiable form to get back to the individual. We 
have mentioned in our submission the suggestion by 
the Department of Health that children should be 
identified as at risk of not eating enough vegetables 
or not passing enough A-levels. There will be 
pressure. Once the data exist in this kind of 
accessible form there will be pressure from 
authorities to say that they want to use it. There will 
also be pressure from the immigration authorities to 
identify illegal immigrants in this way; and there will 
be pressure from the police and certainly the anti- 
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terrorist authorities. Because this is a massive 
database and it is not that difficult to get back to the 
individuals they will say they want to trawl through 
it; after all, they have an overriding public interest. 
That is a serious danger that we will creep into. Data 
protection commissioners in Germany specifically 
addressed part of this and said that the law ought to 
be changed because a doctor would have a right to 
refuse to give evidence about confidential medical 
data held by him in trials. Once the data slip out they 
lose that kind of protection. They felt that the law in 
Germany which was already quite tight ought to be 
strengthened. Here the trend is likely to be in the 
opposite direction. More data will be available, first 
in so-called anonymised and pseudonymised form, 
which it will not be—pseudonymised data will be 
easily re-identifiable—and, second, in identifiable 
form for all kinds of secondary users that the state 
thinks are worthy for the purposes of breaching the 
privacy of the system. It is a recipe for disaster. 


Q231 Chairman: Do you have any evidence from 
any countries where the agencies that rolled off your 
tongue use electronic patient records? You referred 
to the police, anti-terrorist authorities and others 
whose names I have forgotten. 

Professor Korff: | can give no example. 


Q232 Chairman: There is no country where we can 
see how data is used in this way? 

Professor Korff: The United States anti-terrorist 
Operations are basically trawling through any 
database they can place their hands on because there 
are no decent data protection laws in that country. 
I think that in Europe any country with decent data 
protection would be faced with an outcry from the 
Data Protection Commissioner and civil liberties 
groups if this became public. But that is about the 
identifiable uses. 


Q233 Chairman: Do you think this is happening but 
is not identified? 
Professor Korff: 1 do not know whether it is 
happening here. 


Q234 Chairman: I do not mean here but in any 
other country. 

Professor Korff: To the best of my knowledge it is 
not happening in any European country. 

Ms Robins: No other country has this database. We 
are supposed to be leading the world. 


Q235 Chairman: There are other countries which 
have substantial electronic patient record databases 
and the Committee will be visiting one or two of 
them in the next few weeks. That is the case. I just 
want to know whether there is any evidence of the 
multi-use of other organisations of electronic patient 
records; if so, the Committee would be very tempted 
to see how that is done as well. 

Professor Korff: To the best of my knowledge 
nowhere in Europe has this been knowingly done. 
Mr Bamford: Perhaps | may answer your second 
question first. If it helps the Committee we can ask 
our European data protection commissioner 


colleagues whether they have any knowledge of the 
use of electronic patient records. There are electronic 
patient record systems in Denmark and other places 
which use the same basis as we do. There are 
similarities. We can ask and find out whether there 
has been any pressure or whether it has occurred and 
let you know. 


Q236 Chairman: I would appreciate that. 

Mr Bamford: To go back to the original point about 
whether the secondary uses service is open to legal 
challenge, the Information Commissioner’s office 
has always taken the view that the starting point, 
and in many instances the finishing point, for using 
personally identifiable medical information is the 
consent of the patient. If there is a situation where 
there is something specifically provided for in law 
which balances some other competing need in 
society—I am thinking of the Health and Social 
Care Act which has a mechanism for dealing with 
non-consensual uses of personal information—that 
must be done at the will of Parliament with proper 
legislation in place. Here we are talking about 
something that is meant to work on the basis that it 
is pseudonymised personal data. If it is done on the 
basis of true pseudonymisation I agree with 
Professor Korff. If it is truly pseudonymised and it is 
not that easy to look back at the records or bring 
them together and say that they are Jonathan 
Bamford’s or Professor Korff’s I do not think it 
would be open to very much challenge. If the 
pseudonymisation is not effective then that is a much 
more open question. 


Q237 Chairman: That is my next question. Do you 
think it will be effective from what we know at the 
moment? 

Mr Bamford: | do not know enough about the 
pseudonymisation techniques that they are using to 
provide you with an accurate answer. 


Q238 Chairman: Has the Commission looked at 
that? 

Mr Bamford: We have not looked in detail at how 
far they are pseudonymising this, but having heard 
what has been said today we will be asking a few 
questions. 


Q239 Chairman: That would be an issue for the 
Commission? 

Mr Bamford: To establish 
pseudonymisation, yes, it would. 


the level of 


Q240 Chairman: I was going to ask—I think it has 
been answered—about how anonymised something 
is if it has a postcode or date of birth attached to it. 
Do you know of any system where if one is 
uncomfortable with it it could be removed and 
patient records could still be used in a way that some 
people regarded as the general good in terms of 
research, audit or commissioning? If you have no 
immediate thoughts on it perhaps you would get 
back to us. My last question is about the Patient 
Information Advisory Group which considers 
requests from researchers for access to identifiable 
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data without patient consent. How effective is the 
PIAG at balancing the right to privacy with the 
needs of researchers? Do you have any views on how 
that is dealt with currently? 

Mr Bamford: Clearly, there is a statutory provision 
which sets up PIAG. From our discussions with 
them they do seem to take their responsibilities in 
weighing these competing interests very seriously. 
The fact that medical researchers in particular 
appear to want to find other mechanisms other than 
the PIAG arrangements leads me to believe that they 
are, therefore, very strict in what they do, and 
perhaps rather more strict than the medical research 
community would wish. On an anecdotal basis I 
have some confidence in the arrangements that are 
in place. Clearly, the way this was brought about 
under the Health and Social Care Act essentially has 
modified the manner in which the Data Protection 
Act applies to the release of the information, because 
it is something that is now required by statutory 
provision with the safeguard of the PIAG in place to 
make sure it goes forward only where it is a real 
pressing need and there are real difficulties in getting 
patient consent. That mechanism seems to be more 
or less an appropriate one and is working 
reasonably well. 

Professor Korff: My information is anecdotal rather 
than detailed. The anecdotes that I get are somewhat 
different from Jonathan’s. PIAG is quite easy about 
giving access. There are hundreds and hundreds of 
studies on its website. I went to its website to try to 
have a look at how many of these studies had been 
authorised. I sent off an email, to which I have not 
yet had a reply, asking how many studies did it have 
and how many individuals were included in each, 
and to what section of the population did it have 
individualised access. I have not yet had an answer 
to that, and maybe you can ask it. It looks as though 
massive amounts of data are available. I would look 
to Europe to get some guidance. Is it difficult to get 
consent and how important is the research? I would 
go quite a lot further. Is it nearly impossible to get 
consent? What is the substantial public interest that 
allows us to override the individual’s fundamental 
right to informational autonomy and start digging 
through highly sensitive personal data? I would put 
the balance quite differently. Is there any way in 
which this research can be done in a totally 
anonymised or pseudonymised fashion? What is the 
quality of the pseudonymisation? I would like to 
look at it further. I have not looked at it in sufficient 
detail to give a full answer. 


Q241 Dr Taylor: In its submission the Academy of 
Medical Sciences points out how difficult it is to 
obtain consent for records-based research. It speaks 
out against pseudonymisation because it says that 
the identifiers contain useful information for some 
of the sorts of research that it does. This is a 
tremendous conflict and I do not know the answer to 
it. Many of the identifiers that might be stripped 
from data during anonymisation are useful to 
research. Postcodes, dates of birth, dates of death 


and occupations are all routinely used as important 
factors in analysing population data. It is a huge 
conflict, is it not? I do not think there is an answer. 
Professor Korff: The simple comment is that the fact 
they say it is very difficult to get consent suggests to 
me there is a concern that if you explain to people 
what will be done to their data they may not be quite 
so happy about it as is otherwise maintained. To me, 
that suggests this should be taken very seriously, and 
it may lead to an opt out if you explain it to people. 
You cannot say that if you explain to people what 
you will do with their data they will opt out and so 
you should not explain it to them. That is the 
opposite of proper data protection. 


Q242 Dr Taylor: The academy suggests that the way 
forward is to engage the public with full 
information, but it depends on how you give the 
information. 

Professor Korff: Not just full information but 
consent. For secondary uses you need consent. If 
statutory authority is given to override somebody’s 
personal autonomy any state organisation or 
delegated body which says that it will use data on 
that person’s suicide attempt, abortion or HIV 
status in such a way that it can look at the complete 
medical record should be extremely strict in applying 
that. I do not get the impression that they are that 
strict, and the academy’s submission suggests that it 
does not want to be very strict. 

Mr Bamford: Obviously, we are very much of the 
view that we should go for consent and there are 
strong reasons why consent is not possible in that 
regard. I was trying to think of examples to help with 
the point about what other ways there are to deal 
with this matter. Some of the pseudonymised 
techniques use algorithms and things like that to put 
the data in different forms. Rather than just 
stripping out certain personal elements of the data 
one converts it into another form which is not 
readily recognisable to you or me. 


Q243 Dr Taylor: So, there would be a code for your 
date of birth and postcode that nobody else 
understands? 

Mr Bamford: Yes, there are other ways to do it. The 
Royal Academy of Engineering has_ recently 
published a report on the surveillance society. It has 
talked about using engineering to protect privacy. 
There are technical solutions and work is being done 
on it. Other jurisdictions have employed the use of 
what would be called trusted third parties who bring 
together data which might be in a more identifiable 
form and then analyse it in some way and feed it 
back without the identifiable details going to the 
researchers. I believe there is an example of that in 
Australia involving the provision of healthcare to 
the aboriginal community. A third party was 
established. Other models can be used. 


Q244 Mr Campbell: What you have said has been 
very interesting. I have listened to it very carefully. 
What can government do to deal with these ethical 
and legal questions? Should it be made a priority of 
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government with all the things going on in the health 
service and the campaigns that are running? Is it that 
big of a priority? 

Mr Bamford: | have to answer you from a data 
protection point of view. I do not believe that the 
halcyon days of record-keeping on Lloyd George 
envelopes as the best way to look after people’s 
information are acceptable in a modern world. We 
must be able to hold it in effective ways which allow 
people to get the treatment they need. 


Q245 Mr Campbell: That system has never gone 
wrong, has it? 

Mr Bamford: | am not the best person to answer that 
question, but people tell me that it has gone wrong 
before. Patients have been mis-prescribed drugs to 
which they are allergic because information is not 
available to medical practitioners who need it. I do 
not how true that is and there are others better able 
to answer that question. But if there is a concern that 
people do not get the healthcare they need my point 
of view is that if we need wider record-keeping what 
is the extent of it? I believe that it is a priority to make 
sure that if we do need wider record-keeping patient 
information is properly safeguarded. I did not get 
the opportunity to answer the question about the 
Detailed Care Record. My understanding is that 
that will be available only on a local basis and will 
not be uploaded. Some of the questions asked later 
on implied that we were talking about all Detailed 
Care Records being available on a national basis, 
which is not my understanding of the situation. 
Safeguards for lock-down record-keeping at a local 
level where very detailed information is involved are 
the sorts of things to which we should give priority to 
make sure records are secure, robust and accurate. I 
believe that efforts should be put into that, because 
hopefully that will enhance healthcare. 

Professor Korff: The problem is the proposed 
architecture and the idea that too much goes to a 
centralised system and at the front line GPs and 
consultants own the system. Iam not a Luddite; Iam 
all in favour of information technology that can help 
doctors, nurses and everybody. Data should be 
shared where it is appropriate. 


Q246 Mr Campbell: It is really confidentiality about 
which you are concerned. If we can get to grips with 
confidentiality which we have been talking about 
this morning we will conquer it, but listening to your 
evidence I do not think we have. 

Professor Korff: First, you have to focus the system 
on the patient. The most important person in the 
NHS is the patient, not the GP and certainly not the 
manager. Any system that is centrally designed has 
a tendency to turn that upside down. You need to 
build as much as possible with consent and think 
very carefully when you do not need consent, but 
most importantly you need an architecture for the 
system that allows you to build in these principles, 
and my simple response is that the system that has 
been proposed does not do that. 

Ms Robins: We have not solved the problem of 
confidentiality; we have not solved an awful lot of 
questions. I think it is quite wrong to push ahead 


with what are called early adopter sites before many 
of these questions have been answered. At the 
moment the grave impression is that they are making 
it up on the hoof which is not good enough when you 
expect people to opt in or out. It is often said that 
once we have electronic records there will be no more 
mis-prescribing and lost records. Computers are not 
that good. But they have to get it in proportion. For 
instance, an NPSA study showed that for the first 
nine months of 2006 there were 21,000 errors 
relating to records that were lost, illegible, delayed or 
whatever. Of those, 18,000 resulted in no harm at all 
and 12 resulted in death. Obviously, that is 12 too 
many, but when it is compared with 5,000 deaths a 
year from MRSA or one million patients who are 
seen in the NHS daily it is not an enormous push for 
a move towards electronic records for that reason. 
There are other reasons; they can be very useful; they 
can be advantageous to patients, but at the moment 
we are not implementing it in the right way /fit is the 
right thing to implement. I believe that is the way 
patients look at it. 


Q247 Mr Campbell: Should electronic records be a 
condition for receiving NHS care? 

Ms Robins: | think you are talking about Helen 
Wilkinson who has been denied registration with a 
doctor. If you do not have any record at all and there 
is no name, address or NHS number I see a problem 
with that, because with any system like this you must 
be able to know whose record you have; you have to 
be quite sure that you are not dealing with somebody 
with the same name who lives in the same locality 
and looking at the wrong records. Therefore, I think 
that it is unreasonable for patients to object to giving 
certain demographic details. When it comes to ex- 
directory phone numbers it is quite a different 
matter, but I think it is essential to have the name, 
address and NHS number for any set of records, 
simply so that Helen Wilkinson here does not get 
mis-prescribed because you do not know which 
Helen Wilkinson she is. 

Mr Bamford: As | tried to explain to Mr Penning, the 
individual has no absolute right in data protection 
terms to say that no records should be kept on him. 
There is for direct marketing, but we are not talking 
about that here. There is a recognition of the need 
for record-keeping for individuals which is also true 
in the medical area, so I do not understand how 
somebody can simply object and not give an NHS 
number. 


Q248 Mr Campbell: You say that it should not be a 
condition for receiving NHS care? 

Mr Bamford: You can have the health service and 
they can keep the records. 


Q249 Mr Campbell: The crux of the question is that 
when somebody goes to a hospital or doctor he is 
told, “We can’t deal with you.” That is what is being 
said here. 

Mr Bamford: They can keep records locally and the 
issue is whether it is uploaded into Summary Care 
Records which are available nationally. That is a 
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matter of choice, but simple record-keeping of itself 
is something over which individuals have a limited 
choice. 


Q250 Mr Campbell: We are talking here only about 
electronic records. 

Mr Bamford: Yes. 

Professor Korff: | think you have to look at it at 
different levels. If you say, “Unless you agree for all 
your records to be dealt with in the manner we want 
to make them available you will not get NHS 
treatment”, that is coercive. If one says that the 
patient must agree at least to his or her name, 
address and NHS number to be kept on record so 


one knows that the individual is entitled to the 
service in principle that is quite a different matter. 
You have to differentiate. 

Ms Robins: An awful lot of patients who contact us 
ask whether there is some way they can see a doctor 
without their records following them because there 
are many things in them which will influence that 
doctor in a way that they do not want to happen. 
Mr Campbell: That is a good point. 

Chairman: Maybe we should pursue the sealed 
envelopes in relation to that point in our next 
session. I thank all three witnesses very much for 
coming this morning and giving evidence to our 
inquiry. 


Witnesses: Mr Guy Hains, President, Europe Group, Computer Sciences Corporation, Professor Brian 
Randell, Professor of Computer Science, University of Newcastle, and Dr Rob Hale, Confidentiality 
Working Group, Royal College of Psychiatrists, gave evidence. 


Q251 Chairman: I welcome you to the second session 
of our inquiry into the Electronic Patient Record. 
For the record, perhaps you would introduce 
yourselves and the positions you hold. 

Mr Hains: 1 am chief executive of Computer 
Sciences Corporation. My responsibilities span 
Europe. Ours is of the order of £2} billion 
organisation in Europe. We are part of a global 
organisation. I also have specific executive 
responsibility for CSC’s work in this programme 
and that is a role I have held since its inception. I 
personally spend a considerable amount of time on 
the programme. 

Professor Randell: 1 have been a professor of 
computer science at Newcastle since 1969 following 
a career in industry in Britain and America. I have 
been notionally retired for five years, but professors 
do not really retire. My particular research interest 
over many years has been to do with system 
reliability, security architectures and the like. Only 
in the past year have I taken an interest as an 
outsider, not as a medical specialist, in the National 
Programme for Information Technology. 

Dr Hale: | am Dr Rob Hale. I am consultant 
psychiatrist and psychotherapist working at the 
Tavistock and Portman Clinics in London. I am also 
a member of the Royal College of Psychiatrists’ 
working party on confidentiality. 


Q252 Chairman: Mr Hains, Computer Sciences 
Corporation has taken over two of the five local 
service provider contracts from Accenture after it 
withdrew from the programme. 

Mr Hains: Yes, in January. 


Q253 Chairman:. As an opening question, why do 
you believe that you will succeed where clearly 
Accenture felt it was failing? 

Mr Hains: First, obviously I cannot comment on 
Accenture’s ultimate motives for leaving the 
programme, but I think I can give some good 
insights on the basis of comparisons. In our 
execution in the North West and West Midlands, 
which was our original contract award, our strategy 


was very much to address the key secondary care 
environments that we felt would create the central 
nucleus for the sharing and interoperability that this 
programme strives to achieve. In the main GPs have 
reasonable levels of technology. They have chosen 
multiple systems. Certainly, some of them need 
better management and security, but generally it is a 
pretty well automated environment, whereas in the 
hospital environment in secondary care it has been a 
very mixed picture. If one is looking for the essence 
of Connecting for Health that is a very good place to 
start. We made very good progress in terms of 
making more than 70 patient administration system 
deployments in the North West and West Midlands, 
including 11 acute settings one or two of which were 
on a very large scale. The most notable among them 
was University Hospital Birmingham. If we 
compare that with Accenture’s path and plan in the 
other two clusters in which we now operate, it 
addressed and made good progress in the primary 
care and GP sector. In terms of getting energy 
behind the programme and starting to deliver on the 
Connecting for Health aspect of the programme, 
they were not able to make as much progress. 
Second, within our own contract and supply chain— 
I am sure this will be relevant to some of the 
architectural discussions—we are delivering both 
the functionality and operations, whereas Accenture 
were relying on other parties to run the operations in 
the computer centres that supported that 
programme. That gave them some issues of latency 
in their deployment and management. Third, as has 
been commented upon, we have had a longer change 
management commitment as we move to a change of 
a major hospital. We have deployed much more 
assistance in terms of supporting administrative and 
clinical staff in making the change. I believe that that 
approach, whilst it has added time at the front end, 
has helped to industrialise the deployment and 
allowed us to make more deployments than anybody 
else. If we can combine the excellent work that 
Accenture did in primary care with the progress that 
we are now making in their clusters in secondary 
care we will get the best of both worlds. Since our 
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take-over in January we have made a further 51 GP 
deployments and have just brought on three of the 
largest hospitals in Ipswich, Bradford and 
Northampton. Progress is good and we feel that we 
can succeed where clearly they drew the conclusion 
they could not. 


Q254 Chairman: Professor Randell, in total CSC 
now holds three of the five local service provider 
contracts. Do you think this is a serious problem? If 
so, how do we get more competition in this field? 
Professor Randell: { believe that the whole issue of 
architecture and the role of local service providers 
needs to be addressed before that more narrow 
question is considered. When we talk about a local 
service provider we mean a provider that is 
providing a service to a number of patients which is 
equivalent to the population of a medium-size 
European country. That is not very local in my 
terms. In this morning’s discussions there was a 
good deal of debate about locally and nationally 
held data and at times it appeared that “local” 
almost meant “GP” or possibly “hospital” and 
“national” meant the entire English nation. 


Q255 Chairman: We will move on to that in this 
session. I am just thinking in terms of the number of 
LSPs that CSC is now running. Do you think there 
is anything difficult or wrong with that, not the state 
of the architecture adopted by them or anybody else 
running the LSPs at the moment. 

Professor Randell: One can say only that from the 
point of view of reliability in very general terms one 
likes diversity and a number of independent things 
on which one can rely if something goes wrong. One 
can say that the ability to step in in place of 
Accenture is an example of that. In that sense the 
fact there were multiple suppliers had some merits. 
Clearly, one would lose those merits if and when one 
got down to one supplier, but that is almost a 
philosophical answer in the context of reliability. 


Q256 Chairman: Mr Hains, you are reliant on iSoft’s 
Lorenzo product as your main __ hospital 
administration system. When do you _ expect 
Lorenzo to be widely available? The obvious 
question on the back of that is: why has there been 
such a delay? 

Mr Hains: it is absolutely correct that Lorenzo is our 
kernel; it is the centrepiece and enterprise part of our 
solution. We chose it originally because of its wide 
deployment and acceptability in the North West and 
West Midlands. We also chose it because its future 
direction was very much tailored to the operating 
model and forward vision of the NHS. It is not the 
sole product. Many of the solutions that we have are 
more best of breed models. We have products called 
Map of Medicine, Liquid Logic, TPP (for the GP 
and Primary Care Market) and Medusa. I believe 
that to characterise it as a sole dependence or the 
only component of the solution is incorrect. In terms 
of its delays, I point to a number of factors. There is 
no question that the ambition of Connecting for 
Health, in terms of the care pathways and advance 
vision that the UK has, is demanding in terms of 


software building. We will guarantee the highest 
levels of software quality and this procurement has 
raised the bar considerably within the healthcare 
provision software industry. It is frankly a much 
higher bar to jump over. The rigorous testing that is 
going into even the early development is very 
different from the way software providers in this 
market have rolled out systems in the past. That is 
proving to be demanding. It is a product that will 
have more and wider use than purely the UK, and I 
believe that to be a real plus point. In terms of our 
international work effectively we do the spine in 
Holland. iSoft is the predominant software in the 
Dutch environment in terms of healthcare. We think 
that to have a product that is built for more than the 
UK has advantages. That adds some more 
development work to make sure it can be 
internationalised. Whilst it would be inappropriate 
today to comment on its financial position, there is 
no doubt that the uncertainty regarding iSoft and its 
future ownership has proved an unwelcome 
distraction. What I can say is that we are fully 
supportive of iSoft and since the departure of 
Accenture, which was another interested party in the 
development, we are very much more focused on 
Lorenzo. We have 100 people working in the iSoft 
organisation co-developing that product, and the 
NHS has also dedicated 23 clinical and healthcare 
professionals to work full time to ensure that the 
requirements are optimum for the early delivery. It 
is getting an awful lot of support to get the fastest 
timing and delivery is due in the middle of next year. 


Q257 Chairman: You have told us why you believe 
you do not want to move away from iSoft. As you 
rightly point out, there are other suppliers, but 
presumably they have to reach the higher bar as well 
that has been set for the National Health Service. 
But you still believe that you took the right decision? 
Mr Hains: Yes, we do. There are over 103 product 
and solution providers accredited and certified by 
the NHS. In terms of areas of specialism, this is not 
a one size fits all; it is a best of breed-type solution 
set. We are making good progress with iSoft and 
believe that it is a very good solution for the NHS. 


Q258 Dr Taylor: Mr Hains, I want to turn to some 
of the detail of the system design because you should 
be in a position to tell us. Turning to the Detailed 
Care Record, what will be in it? 

Mr Hains: Building on the discussion that preceded 
this, I should try to make it clear where some of the 
records are and what the vision is in terms of how 
they will be made secure and accessed. 


Q259 Dr Taylor: Before you go to security, what are 
they and where will they be? 

Mr Hains: The Detailed Care Record is variously at 
the GP and a secondary care setting like a hospital 
where your treatment record will be held. 


Q260 Dr Taylor: It could be at either? 

Mr Hains: That is correct, as it is today and it 
operates through referrals, results and letters 
between the two. 
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Q261 Dr Taylor: I take the Detailed Care Record to 
equate much more to the detailed hospital notes 
rather than the GP. I do not wish to be derogatory, 
but they can write only a very small amount. Will 
you take into account the detail in hospital notes? 
Mr Hains: The system in terms of being able to log 
both at free text and code level will reside as it does 
today in the software in hospital systems. That will 
reside in the location where that treatment takes 
place on the resident database. I need to make it 
clear that in terms of the deployments we have made 
to date this is not a single database. I shall talk a little 
later about the instances and systems that support 
that. 


Q262 Dr Taylor: As far as I am aware, hospital- 
based systems at the moment certainly include 
radiological and pathological results but not what I 
regard as the nitty-gritty of patient histories, 
physical examinations and contacts with relatives 
and details about the patient. How will you include 
those? 

Mr Hains: As to the full systems resident and 
available at the hospitals it is correct they are 
variable in terms of the amount of detail held. Some 
of it is in code form; some of it is in free text, and it is 
available for all the healthcare professionals in that 
hospital, if they have the correct and proper access 
rights to add to that record. 


Q263 Dr Taylor: Do you envisage that your Detailed 
Care Record will completely abolish the need for 
paper records? 

Mr Hains: Asa technologist I think there will always 
be a need for reference to a file of original documents 
to be held, but the vast proportion of currently held 
records in not very secure environments generally in 
hospitals will be replaced by automation. 


Q264 Dr Taylor: I do not argue with that. Hospital 
notes are so difficult to find they are incredibly 
secure! 

Mr Hains: At the moment the simple answer is that 
individual hospitals can make their own decisions 
regarding how much data will be stored. The systems 
have the ability to capture and record that data 
electronically. 


Q265 Dr Taylor: Will they make their own decision 
whether or not to keep a paper record as well? 
Mr Hains: Yes, as indeed they do today. 


Q266 Dr Taylor: Practically speaking, we can see 
that the detail will remain in the paper file and there 
will be a certain amount of codified information on 
the computer system and that is really all there is? 
Mr Hains: Individual hospitals are making their 
own decisions regarding that. If one looks at, say, 
University Hospital Birmingham it has an advanced 
view; it wants to move to a very high level of 
electronically-stored records. Other hospitals may 
choose also to have a reference to paper-held 
records. We are not mandating the level of efficiency 
and automation to which those hospitals take their 
full records. 


Q267 Dr Taylor: Will the Detailed Care Record be 
held at the GP and hospital level? 

Mr Hains: Effectively, today most of the medical 
history will be at the GP level. When one goes to a 
hospital there will be rules-based access and controls 
as to who can add to and see that record, and the 
notes that go back to the GP are likely to be a 
summary of those outcomes. There will be a residual 
record regarding that episode held at the hospital 
with all the detail that takes place. Effectively, as it 
is today you will have the GP with his records and a 
hospital with the records of the details of the 
consultations and departmental activities that have 
taken place. 


Q268 Dr Taylor: Is it only the Summary Care 
Record that will be available nationally? 

Mr Hains: That is the current view. As has been 
discussed this morning, there are proposals to build 
upon aspects of the Summary Care Record in future, 
but at the moment that summary provides a very 
effective pointer and common reference to where 
data is held across what is a very complex 
environment. The answer is that the benefits of the 
Summary Care Record are in effect to provide 
consistency of data, to avoid duplication of records 
and effective electronic linking and connectivity 
across the health environment. Those who are using 
it attest to the value of that. 


Q269 Dr Taylor: How do you ensure that clinicians 
have input to what is in the Detailed Care Record? 
Mr Hains: In terms of the distinction between the 
national programme and its vision of a Detailed 
Care Record that is more a matter of policy. I am 
here to build the systems to support that. As to the 
sophistication of the systems that we are making 
available to hospitals, before we go anywhere near 
implementation we would work with clinical leads— 
administrators—to discuss what components, 
attributes and aspects of the system they want fully 
to exploit. The system’s architecture and its ability to 
provide that connectivity is common, but there is a 
lot of local latitude as to how people want to use the 
systems, what particular emphasis they want the 
system to provide and, if you like, the depth of the 
data that they want to provide. 


Q270 Dr Taylor: Therefore, in the hospitals that you 
work with clinicians have a definite say as to what 
does and does not go into the Detailed Care Record? 
Mr Hains: Yes. Remember that in terms of our 
deployments to date we have been working on the 
patient administration system. With the recent 
implementation of Ipswich and others, we are 
moving out to support more of the clinical practices, 
but it is absolutely the clinicians who create the 
records. We work with expert user groups and 
reference groups because we want to keep a level of 
commonality in the deployed systems that we 
provide, but it is absolutely within their control in 
terms of the specification. 


Q271 Dr Taylor: Have you given specific thought to 
confidentiality and security? 
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Mr Hains: Yes. 


Q272 Dr Taylor: How are you tackling that? 

Mr Hains: \t works at a number of levels, but in 
terms of access security which is key the issuing of 
smart cards is not our responsibility but is really at 
the start of the life cycle of the security profile. That 
involves not just the card but effectively a PIN and 
how it is then implemented into our systems is very 
complicated. Therefore, individuals can have 
multiple roles’) and they can be multiple 
organisations. Your card is specific to how you 
operate in the NHS. Your access to data is limited 
strictly to the role you are performing at that time 
and the organisation for which you are doing it. 


Q273 Dr Taylor: I think we will come to smart cards 
in a bit more detail. Dr Hale, referring to the 
Detailed Care Record, what input into this have 
psychiatrists had round the country? 

Dr Hale: This is one of the problems. Speaking from 
the point of view of my own trust and the Royal 
College of Psychiatrists, we have not been able to 
make a great deal of input. Our experience is of 
learning about the design of the system as it 
develops. Obviously, there must be flexibility built 
into the design of the system that one must learn as 
one creates it in terms of what is appropriate, but 
there is a problem about taking into account the 
views of clinicians in the design. 


Q274 Dr Taylor: Would you insist on the psychiatric 
part of a Detailed Care Record to be entirely 
separate from the rest of the system as on the paper- 
based notes at the moment? 

Dr Hale: \f it reflects current practice in most 
hospitals it would be separate, but obviously there 
are situations where the two have to be combined. 
That is obviously the case in, say, liaison psychiatry 
where one has a patient on a general medical ward 
who has a psychosomatic condition. In that case the 
psychiatric opinion is of direct relevance to the care 
of that patient. In those circumstances it is envisaged 
that one wants a system that reflects that sort of 
flexibility. There would be situations where they 
would be kept separate and situations where they 
would be combined. 


Q275 Dr Taylor: Is that something that you can take 
into account? 

Mr Hains: Yes. This may well be a matter of timing 
in terms of rolling it out to the different disciplines. 
We certainly want the input of expert groups as we 
effectively set the parameters for the system. In terms 
of the ability to control the visibility of data, some of 
it is clearly mandated by the national programme 
and some are inherent in our system. Inherent in the 
system that we are deploying—even to the extent of 
the point made this morning—we can suppress the 
name or address most relevantly for somebody who 
says that she is a concerned and battered wife who 
does not want her address visible as she makes her 
way round the healthcare system. We can do all of 
those things within the system. Clearly, we have been 
working not only with the issue of defined access to 


the systems. For us, in September there will be the 
establishment of the full legitimate relationship so 
that across organisations one will really be 
controlling who can see data. Most importantly—it 
is not just a footnote—the advantage of the 
technology is that one has a full audit trail of who 
has accessed the data which is not true of paper 
records. I believe that that is both a huge deterrent 
and, frankly, control as we go forward. 


Q276 Dr Taylor: Do you foresee that you will be 
combining existing computerised records that 
already exist? Will you be building on those? 

Mr Hains: Absolutely. One of the concerns that has 
been voiced is about the size and the endeavour of 
this programme. I would point to University 
Hospital Birmingham which is perhaps the largest 
one we have done, although Ipswich is probably 
close to it. We brought into the new system 10.2 
million rows of customer data relating to existing 
patients. This was data that we had to go back and 
cleanse. Frankly, we had to take out thousands of 
duplicate records because of the level of computer 
sophistication in the prior system. 


Q277 Dr Taylor: So, this was on computer already? 
Mr Hains: Yes. We brought it across in order to 
make their system work and be operable. All of these 
systems require us to look at prior data and also 
interfaces between our core system and other 
systems that are operating. The deployments that we 
have done are voluntary on the part of the trusts that 
have chosen to take the system, so we have to satisfy 
them not only that we will not interrupt their day-to- 
day operations but that we can fully underwrite the 
implementation when it takes place. Needless to say, 
to satisfy them that we are carrying across all of their 
existing patient data is an absolute must. 


Q278 Dr Taylor: Was there much free text data on 
that? 

Mr Hains: | do not believe there was, but the fact 
that we are now interfacing to a lot of resident 
systems that are still there, which we will replace over 
time, ensures we have that connectivity to the 
departmental systems which have within them 
mainly free text data, so the answer is: yes, we have 
protected that. 


Q279 Dr Taylor: Professor Randell, do you have any 
comments on the security of patient records? 

Professor Randell: That is very much an open-ended 
question. A comment was made this morning about 
the inability in practice to have great scale and 
functionality and high security at the same time. I 
totally agree with that. Another point I stress is that 
the systems that we need to talk about are not just IT 
systems composed of hardware and software. The 
people involved in those systems are an incredibly 
important part of that. In saying that, I have in mind 
that I was involved in initiating a very large research 
project on the dependability of computer-based 
systems. When I say “dependability” I include 
reliability, safety and security. Most of the work on 
that project which involved five universities over six 


The Electronic Patient Record: Evidence Ev55 


10 May 2007. Mr Guy Hains, Professor Brian Randell and Dr Rob Hale 


years turned out to be concerned with research on 
people with computers in the health area, although 
that was not the original plan. The sort of things that 
that project revealed was that when looking at issues 
of reliability and security the people were of crucial 
importance. They are both the source of problems 
and solutions. Typically, the medics are capable of 
achieving what they want to do despite if necessary 
the computer, and there are a number of very careful 
ethnographic studies within our project and many 
others which testify to that. I give a simple example 
of how a person can help. Bed management in a 
hospital may well be done by lying to the computer 
which is trying to do it naively. I am sure that we will 
get to more issues of human beings being the causes 
of losses of security and privacy. But the 
combination of scale, high security and complicated 
functionality and the role that people play means 
that we should not be talking just about computer 
systems and looking at how well those apparently 
work. 


Q280 Mr Campbell: Do you think that the greater 
threat to security of the new electronic record 
systems will come from insiders or outsiders? If it 
does, why? 

Mr Hains: Perhaps I may comment at the moment 
on the “outsider” piece. We have had to meet some 
very exacting standards around pure physical access 
and the level of encryption of any data that moves 
up and down a wire between a terminal and at any 
centrally-based or locally-based computer. I can say 
that under the supervision of the NHS/Department 
of Health we regularly undertake ethical hacking. 
We are trying to break our own systems and use the 
brightest and best, as we do on a global basis. 
Effectively, we employ a division of hackers to see if 
they can break the system. I can say that that has not 
been achieved to date, but as more functionality is 
added it will be continued. I also need to dispel the 
myth that this is a monolithic system. In the North 
West and West Midlands we have implemented just 
over 70 patient administration systems which are 
contained in 31 computer images or sets with 
physical boundaries around them. This is not all on 
one monolithic system, which is very important. 
Effectively, the NHS defines what it wants grouped 
on the system. For example, a large one would be 
Morecambe Bay Acute Trust where there are 2,500 
users effectively on one system compared with 
Greater Manchester where today it is getting real 
benefits across various healthcare settings by 
sharing. They have a system for Greater Manchester 
with about 13,500 users on it. But it is not one big 
system; it is divided up, which means a lot for 
reliability. | absolutely agree with Professor Randell 
that there is a relationship between scale and 
vulnerability and many aspects of being able to 
operate the systems. The other issue is: what security 
environment wider than the physical environment 
does one really operate? Here we have chosen to use 
ISO 27001 which is an all-embracing security policy. 
It covers not just the assets of the organisation—HR 
and physical aspects—but also business continuity 
and all the things one would expect; it is a whole 


world of security management. We are not just 
compliant. We have sought and gained certification 
for that standard for the North West and West 
Midlands. We shall also be certifying the two 
additional clusters that we took in January from 
both an operational and design point of view. I 
completely agree with some of the issues of scaling. 
I believe that we have addressed that in this 
compartmentalised environment and that to take on 
board a very wide and internationally accredited 
standard for security is the right framework within 
which to work. Things like testing of systems on a 
very regular basis as the programme goes forward 
not only for hacking but also to ensure you can move 
smoothly between main data centres and residual 
data centres are also matters that we shall do on a 
regular basis. I believe that those issues provide the 
safeguards. 

Professor Randell: | believe that the direct problem 
will be to do much more with insiders than outsiders, 
though it may well be that the insider problem is 
caused by attempts by outsiders to subvert, distract 
or confuse insiders. One study I have heard about 
shows the extent of the problem. I believe it was 
found that in a single North Yorkshire hospital 
about 30 telephone calls a week were being made by 
people trying to obtain information illicitly by 
purporting to be somebody other than who they 
were. I am sure that that is by no means likely to be 
untypical. The more one has a system where there is 
the potential to get lots of valuable information the 
more one will have such attackers. I do not suggest 
that those are attackers who will achieve results by 
hacking into the Internet. I am prepared to assume 
that insiders being fooled into doing things that they 
should not do will be a bigger problem. That is why 
I believe it is crucial to talk about the system as being 
not just the computer but the set of people around it. 
It is one thing to try to deal with that sort of problem 
if one is, say, a military organisation but another 
matter if one is talking about a situation where the 
insiders are much less regimented but, though they 
probably have a rather stronger ethical background, 
are very likely to be fooled or possibly bribed into 
breaking security. 

Mr Hains: The issuing of smart cards is a very good 
example. We have to be very aware and super- 
sensitive to some of these issues. The sharing of 
smart cards was really about the fact that the system 
did not provide a sufficiently immediate log on for 
people who wanted to use the system quickly. The 
log on times were quite adequate for somebody who 
wanted to operate the system for an extended period 
of time. Somewhere between 30 seconds and a 
minute is often what it takes to fire up your own PC, 
which is not onerous, but for somebody who really 
wants to use the system, open a session, do a 
transaction and close the session that is far too long. 
In terms of raising the bar we recognise the need for 
a smart card log on procedure of 10 seconds; 
otherwise, the ergonomics of the environment will 
start to open up people’s pragmatic behaviour to try 
to use the system in different ways. I think that the 
quality of the system and the controls and policy 
managed locally are all parts of those issues. One is 
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all too aware that one must have a performance 
system to which one can rigorously apply the 
controls and people disciplines required. 


Q281 Mr Campbell: Mr Hains, do you argue that the 
ethics of the National Health Service staff are as 
important as the technical security measures in 
maintaining the privacy of the patient data? Are you 
not just passing the buck a little? I know that you 
have hackers but what else? 

Mr Hains: To go back to the point that we just do 
not come and implement a system; we are working 
with the staff of a local trust to provide a good code 
of conduct as to how those systems will be used but 
also good training is part of addressing the issues 
that you have just mentioned. The code of conduct 
mirrors the code of conduct that would be expected 
in the NHS today with a paper-based record which 
has many more vulnerabilities in terms of where it 
may be left, how it may be handled and through 
whose hands it will pass, but I think that the system 
and workflows that we are putting in mirror as 
closely as possible the ways of working and conduct 
that I know the NHS demands of its staff. I believe 
that it is adding to the controls in terms of what takes 
place within the boundaries of the departments. The 
path to more connectivity is the programme that we 
are pursuing with the NHS and how much of that 
will be opened up will be decided through policy, the 
expert groups and colleges of medicine. But I think 
that in terms of the efficiency we are providing in 
care settings today it very much mirrors and is 
helping to support and automate good practice as it 
exists in the NHS. 


Q282 Mr Campbell: Dr Hale, I think that in the 
previous question you touched on the psychiatric 
records of patients being passed through the system. 
I think you said you did not believe in that. 

Dr Hale: No. | said that there were circumstances in 
which it was appropriate that it should be a shared 
record and circumstances where it should be a 
separate record. The question that arises is whether 
that separate record has the same access and what 
access other professionals have to that psychiatric 
record, which is the envelope. 


Q283 Mr Campbell: Is it a matter of getting the 
balance right in the case of psychiatric patients? 
Dr Hale: Yes. 


Q284 Mr Campbell: Will it be difficult? 

Dr Hale: | think you must start from the assumption 
that people who consult psychiatrists do so in a state 
of mind which is different from that when they are 
well. The basis of that consultation is the entrusting 
of personal information to the healthcare 
professional. In those states of mind which they are 
experiencing, namely the anxiety and depressive 
states, perhaps the more serious psychotic states, 
there are various characteristics which alter their 
perception of systems, in that when they are 
depressed they have a diminished capacity to trust 
impersonal systems. We perceive the world as being 


less trustworthy; we have a greater need to control 
what is happening to that information. Therefore, 
that is a very special situation. 


Q285 Mr Campbell: Can you give me an example of 
a patient who in your opinion should not go on the 
record? What would be the conditions on which that 
patient’s information should go onto the electronic 
record? 

Dr Hale: For a start, I very much agree with what 
was proposed by Professor Korff and Ms Robins in 
the previous session, namely that patient consent is 
absolutely crucial and it must be informed consent 
to specific information going on the record which is 
relevant to that particular episode. The professional 
in conjunction with the patient should have control 
over the flow of that information and it should not 
just be passed through a system and then control is 
lost. All of these matters are very relevant to people 
who are in states of psychiatric disturbance. 


Q286 Chairman: We have touched a little on smart 
cards. I just want to develop it a little more. We are 
told that role-based access controls are the best way 
adequately to protect the privacy of patient records. 
Do you think that is the case? 

Professor Randell: Yes, if role-based access controls 
are allied to an appropriate security policy model. It 
seems to me that the appropriate one is that 
developed in conjunction with the BMA a few years 
ago at least in part by Professor Anderson. Those 
together seem to make sense and work reasonably 
well, perhaps very well, at least in a modestly sized 
environment. The question is whether they really 
work in a very large environment where one has tens 
of thousand and not hundreds of people. It is 
amazing how many unlikely things will happen. 
That is the problem of scale. These are things that 
you could never have conceived should be designed 
or catered for. They will become almost the norm. If 
one has role-based access control with a very large 
number of complicated roles in a situation where 
there is a lot of changing roles it will be extremely 
difficult to deal with all the individual decisions that 
are being made as to who should have what role and 
what privileges. To validate in a rigorous way that 
the system as a whole is obeying whatever policies 
one has decided it must obey becomes a tremendous 
problem. I cannot give you a mathematical 
argument as to whether it will work for 10,000 
people but fail for 100,000, but I am deeply 
suspicious of the practical efficacy of such a system. 
Again, it is a system of computers and the people 
who manage it and make all of the decisions on roles. 
The question is how it will work on that scale. 


Q287 Chairman: Do you have any experience of any 
of these systems working elsewhere in the world on 
a larger scale than in the UK? 

Professor Randell: { do not know of systems of this 
complicated functionality and scale, or possibly just 
of this scale. 
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Q288 Chairman: Is your basic theory that if the 
system comprises 1,000 records one will go, if it is 
5,000 five may go and if it is 500,000 it just grows 
incrementally? 

Professor Randell: That is the sort of thing that Iam 
worried about. If one looks at the word “system”, 
one builds systems out of systems. One can use 
several systems together and what one has again is a 
system. Errors can permeate from one system to 
another if there is any means of communication. 
One tries to put in firewalls and means of preventing 
this, but as far as lam concerned the whole NPfIT is 
a system because things are connected together. One 
has to look very carefully at those connections to 
make sure that one is not only connecting things 
together to do what they are supposed to do but 
ensure that one is not connecting them together in 
such a way that damage can flow from one system 
to another. 


Q289 Chairman: I accept that, but firewalls are not 
new in terms of IT systems. 

Mr Hains: To look at the whole regime, I believe that 
role-based access is one aspect. Legitimate 
relationships and the disciplines around role-based 
access where one is in the area of records crossing 
boundaries should be looked at. As to why an 
individual through either a referral or other granting 
of right will in effect have the ability to access a 
record, the reasons will be very explicit and all of 
that is subject to an audit trail. 


Q290 Chairman: Y ou refer to an audit trail. Will the 
system be able to pick up a breach of what should 
have happened; in other words, if somebody did 
access a record he should not have done? 

Mr Hains: On inquiry, clearly in terms of legitimate 
relationships it will track both those and attempted 
access for which there is no legitimate relationship. 


Q291 Chairman: If it was not a role-based access it 
would highlight that fact? 

Mr Hains: Yes. That boundary is also the 
opportunity for patient consent consideration, 
because at that point the patient can effect a 
statement about what he or she does or does not 
want provided in sensitive areas of mental health or 
sexually-transmitted diseases. Those are key factors. 
There is then the sealed envelope and its outline 
design. 


Q292 Chairman: We will move on to that in a couple 
of minutes. We had the example of a smart card 
being used in an A&E department. Some hospitals 
have allowed staff to share smart cards because, as 
you pointed out earlier, it takes too long for one 
clinician to log off and another to log on. Is this a 
serious privacy or safety problem, or is it something 
that we should see as inevitable in busy departments 
like A&E? 

Mr Hains: From a design point of view we have to 
respond to it. That must be deemed to be bad 
discipline and it is really about us being able to 
provide very short lead times to log on, which need 
to be at 10 seconds. Clearly, that was a local 


accommodation due to a poor time to gain access, 
and that is where there is a weakness in the system. 
The weakness is that ergonomically people need to 
circumvent controls and processes because they do 
not meet the need. We are super-sensitive to that. In 
terms of both the input we get to modifications and 
redesign but also in terms of our individual 
deployments there are regular checks in talking to 
the end users to ensure this will be fit for purpose. 
That is a good case where if it was not addressed you 
would have a clear security opening. That needs to 
be closed. 

Professor Randell: | think that the seriousness of it is 
a matter for the medics, medical ethicists and so on. 
Clearly, that was a violation of what was intended. 
As to whether the figure of 10 seconds is right I 
would be interested to know how that has been 
established on the basis of realistic trials and in what 
sort of environments. I can imagine a trial in one 
hospital department would come up with a rather 
different answer from one in an A&E department. 
An interesting model is the use of smart cards by 
barmen in crowded bars to ensure that payment goes 
into the till and that the responsibility for the 
particular sale is clearly identified. They are also 
acting on commission. Those are little systems that 
can be exceedingly fast, but there they have 
obviously got the ergonomics right. I am not 
convinced that an A&E consultant will be so easily 
convinced to change his habits of a lifetime and start 
working on a new system, particularly if he and the 
atmosphere around him believe it to be a system that 
is imposed upon them rather than one they have 
chosen, learned to trust and see grow gradually into 
something bigger with which they are still happy. 
There are big issues here which are not simple 
technical ones. Clearly, the issue of speed is vital but 
I do not believe that is the whole problem. 


Q293 Chairman: Dr Hale, if consultants accept 
overall responsibility for a patient under their care 
could they not also accept responsibility for all the 
data entered in the course of providing that care? If 
so, in a sense the sharing of smart card is not really 
a problem. 

Dr Hale: | am not sure I understand the second part 
of your statement that sharing smart cards is not a 
problem. I accept the first part of the proposal. 


Q294 Chairman: Basically, as a clinician do you 
think it is difficult to share smart cards in a situation 
as I described earlier in an A&E department, though 
I agree that it is a bit more difficult in terms of patient 
records? You accept that you are responsible for the 
data that goes onto the record. 

Dr Hale: Yes. Assuming as Professor Randell says 
that I believe the system is one that I want to make 
work, a delay of 10 seconds should not stop me 
making use of it. 


Q295 Chairman: I accept that. All things being 
equal—at the moment we know that it is not—if an 
A&E department gets as smart as the till in the local 
bar in those circumstances that is not a problem. But 
what about the sharing of smart cards? I went along 
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to one of my GP surgeries a few months ago. They 
complained about smart cards and access. I found 
out that they had 11 in that surgery but only five 
GPs. I asked why they had another six smart cards 
in the surgery and was told that they were for the 
people who did all the letters. There will be issues 
about that. This is about patient management. Is the 
issue of sharing smart cards as big an issue as some 
would have us believe? 

Dr Hale: | think that the situation you describe is 
one that is bound to recur, and it goes back to the 
controls one has over staff who may have access but 
are not bound by the same rules, for example 
secretaries. They are bound by the same rules as far 
as the trusts are concerned in terms of conditions of 
employment, but they do not have professional 
bodies to whom they are answerable, so the controls 
and sanctions will be considerably less. 


Q296 Chairman: Let us take a GP surgery and Lloyd 
George records. Anybody who has access to the 
room in which they are stored can take hours and 
hours to look for something and find absolutely 
nothing. That is not the case with IT, is it? 

Dr Hale: No. 


Q297 Chairman: If one of those smart card holders 
can access all the records in a GP surgery within 
seconds will that be a good or bad thing? 

Mr Hains: Therefore, the design content of the 
access control is that an administrator responsible 
for follow-up letters or referrals is effectively limited 
to the part of the system that allows her to conduct 
that task. 


Q298 Chairman: Would access to that particular 
patient record be traceable or measurable? 
Mr Hains: Yes. 


Q299 Chairman: What I am trying to get at is that we 
could not have anybody going in without knowledge 
that that person is surfing the records of a GP 
surgery? 

Mr Hains: Correct. 


Q300 Chairman: It was suggested to me that that was 
wrong because there were 11 smart card holders in 
one surgery. I want to establish whether or not it is 
wrong. 

Mr Hains: To go back to your comparison, yes, the 
person may not find the Lloyd George record or may 
be able to browse and read the complete record, so 
there are both sides to it. But the design intent is that 
we have a pretty sophisticated way to limit access to 
various parts of the system based on what is a very 
wide range of roles and authorities within the NHS. 
I believe that it is fulfilling that purpose. 

Professor Randell: There is the auditing of accesses 
in various roles which in principle is obviously a 
good idea. If, however, one has a system where it 
turns out that there are huge numbers of audit 
records being generated to the point where nobody 
is looking at them, that is a kind of overall system 
that is not being properly designed. It is unwise to 
assume that just because something has been audited 


and the computer asks whether you really want todo 
this people will always put in the necessary amount 
of thought. If a doctor is repeatedly asked “Are you 
sure you are permitted to do this?” the response will 
become a reflex action rather than one that is 
thought out. There are human and computer issues 
that must be properly sorted out in conjunction. 
Chairman: I am not sure how one can design an 
electronic system that is comparable with the human 
mind and what we as individuals can and cannot do, 
but we will leave that for another day. 


Q301 Sandra Gidley: I come to the subject of sealed 
envelopes. Mr Hains, Richard Granger in a previous 
session assured us that technology would be 
available by April 2008. Are you equally confident? 
Mr Hains: There is the issue of specifications. 


Q302 Sandra Gidley: I will come to that. 

Mr Hains: | believe that is quite important. In terms 
of the system capability that we have envisaged and 
for which we have an outline design, it is to the level 
of the two-part sealed envelope: one that is opened 
in an emergency and one that is just locked. From 
the point of view of technology and building it into 
the system, we understand how to do it, but what we 
need however is a clear specification. 


Q303 Sandra Gidley: You do not have that yet? 
Mr Hains: No. We need a clear specification as to 
how that will be used, in what environments it will 
be used, how it will be deployed and an idea of the 
data sets and information that would go into that 
sealed envelope. We have a timetable. 


Q304 Sandra Gidley: How can you have a timetable 
without a specification? Surely, in any IT project 
those two go hand in glove. 

Mr Hains: | have to say that on this programme it 
comes down to complex decision-making within the 
NHS. We have reviews. We have yet to get a fix on 
the precise operation of how sealed envelopes from 
a policy, not IT, point of view will work. Clearly, we 
can build systems that have flexibility. For example, 
today our systems can respond very quickly to 
whatever the policy decision may be around consent 
that is required for the uploading of a summary 
record. We have built in the capability but it has to 
be explicit and not mere passive consent. We also 
have an outline view of how we would implement 
sealed envelopes, but we need a firm specification on 
how it will operate. We can stipulate, but not today, 
that if we are looking for implementation in 2008 
then by such and such a date we need a much finer 
level of clarification as to the exact requirements. We 
are timetabling many of the requirements of this 
programme on a forward basis without yet having 
the full definition of how it needs to operate. 


Q305 Sandra Gidley: I am very much warming to the 
idea of Mr Granger coming back before us. When 
were you first asked to develop sealed envelopes? 

Mr Hains: Perhaps I may first clarify one matter 
which will help you with Richard Granger’s 
comment. His comment regarding sealed envelopes 
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relates to the spine. Our sealed envelope 
environment must be implemented in the local 
hospital and other systems that we = are 


implementing. As to the LSPs and our role in 
creating these environments particularly within the 
secondary care environment, we will be undertaking 
that following the spine implementation. I know 
that there is a specification for the spine with a 2008 
planned implementation date. I need a more detailed 
specification to implement those within our LSP 
environment. 


Q306 Sandra Gidley: Is that a_ different 
implementation date? Can you give us some idea 
when that will be? 

Mr Hains: \t will follow, so it will be either later in 
2008 or 2009. 


Q307 Sandra Gidley: Are you confident about that? 
Mr Hains: Yes. 


Q308 Sandra Gidley: But you have not yet had a 
specification? 

Mr Hains: We do not yet have a detailed 
specification, and I think that the review and 
discussions that are taking place with all the 
professional bodies will ultimately define exactly 
how the sealed envelope will operate. As you would 
expect, I need to know the types of data and its 
amount and the capability required in a documented 
specification for the sealed envelopes. 


Q309 Sandra Gidley: Earlier there was some talk 
that this should be available only with the 
knowledge or permission of the patient. To the best 
of your knowledge is that part of the discussion that 
is taking place? 

Mr Hains: No. In terms of making it available I 
think that from a systems point of view—I need to 
separate policy from systems—if we build it in it will 
be universally available. 


Q310 Sandra Gidley: Have you stopped just 
anybody opening it? 

Mr Hains: | misunderstood your question. I thought 
you asked whether the sealed envelope capability 
would be universal throughout our systems. It will 
be. It is for policy to decide under what 
circumstances sealed envelopes may or may not be 
opened. We will imbed those rules and controls 
within the system, but I do need a specification with 
which to do that. 


Q311 Sandra Gidley: Dr Hale, obviously you 
approach this from the perspective of mental health. 
Given what you already know and have heard 
today, do you think that the sealed envelope 
technology provides suitable protection for the sort 
of information that might be recorded? 

Dr Hale: | do not know about the technology, but 
the starting point of whether the patient has control 
over what is in that sealed envelope and the 
circumstances in which it may be revealed is 
absolutely crucial, so the answer to the question is 
different. 


Q312 Sandra Gidley: Have you been asked to input 
into that process so that the people who are 
designing the process eventually get a spec? Where 
are we going with this as far as your involvement is 
concerned? 

Dr Hale: \t must be said that the college has been 
involved in reacting to proposals rather than at the 
fundamental design stage. The proposals for sealed 
envelopes were put forward and we then reacted to 
them. Further, we have reacted rather than become 
centrally involved in the question about opting in 
and opting out of all the record. It may be there were 
breakdowns in communication but to my 
knowledge we have not been involved in that 
central design. 


Q313 Sandra Gidley: What security measures are 
used elsewhere in the world? Is there any evidence 
base as to whether it works? How much of the 
programme for IT is just a huge security experiment? 
Professor Randell: First, there is danger in assuming 
that one gets security just by having a good set of 
security mechanisms like smart cards, role-based 
access control, auditing and the like. Security 
failures are typically nothing to do with that. 
Professor Anderson’s most famous paper is one I 
know very well because a number of years ago it was 
part of his PhD of which I was his examiner. That 
was about how systems actually failed to maintain 
secrets. It is because those mechanisms though 
individually may be capable of doing what they are 
supposed to do are imbedded in an overall system 
such that there are other faults in it. As an analogy, 
one can have a wonderful door to a safe but if you 
build it into a bank that is made of rotten plywood 
it will not do you much good. Perhaps that is a silly 
way to describe it, but the case is that virtually all 
security failures do not arise because of the 
inadequacy of the little mechanisms but the overall 
system into which they are built and the mistakes 
made in it. When one has an overall system which 
involves a huge amount of software there is a 
tremendous validation problem to deal with. That 
was a long preamble to your question. I have not 
been able to find detailed scholarly studies of the 
effectiveness of such mechanisms—not even smart 
cards—particularly in a healthcare environment. 
One can find quite a lot of documents extolling the 
merits of smart cards but not evidence on which to 
base policy. It strikes me that sometimes we have 
policy-based evidence rather than evidence-based 
policy. 

Mr Hains: | think that the National Programme for 
IT has described the security as state of the art, not 
breaking new ground and I attest to that. As one 
looks across from the healthcare environment to 
banking and other environments one would describe 
them as being very fulsome in their use of what is the 
best available today. That must be capable of 
upgrade and we have to demonstrate that we can do 
that. I agree with Professor Randell that the issues 
are not so much technical as about how the systems 
will be used and the quality of housekeeping and 
controls. I hope that one of the important messages 
I have got across is that it is not one large monolithic 
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system, which is important for a number of reasons. 
Clearly, it is important for control of access and 
breadth of access, but it is absolutely the case that 
more modular, simpler and smaller systems are more 
easily protected and upgraded in future. That is 
exactly the approach we have taken. There is 
emphasis on keeping tight controls and boundaries 
and, through policy that is directed to us, firm levels 
of control over message-passing and encryption, 
making sure that the connectivity that we create is 
safe. That is the essence of the design. 


Q314 Mr Campbell: Mr Hains, we heard in the 
previous session that Connecting for Health had not 
set any targets for an acceptable number of security 
breaches. Is that true? Is there any in your 
department? 

Mr Hains: | think Professor Randell would say that 
one needs to look at a broad range of measures 
around the whole area and it is not just “up” times, 
security issues or the ability to monitor the system 
that is important. Around the system controls we 
have a battery of measures with the NHS. Its 
robustness and ability to withstand tested breaches 
is part of both our contracted and managed 
environment with them. 


Q315 Mr Campbell: But if there are no target figures 
how can patients be reassured? 

Mr Hains: We measure that in terms of supervised 
attempted access. We have regular audits and review 
of the security policies that we have put in place. 
There is not a target. If your question is whether it is 
acceptable to have five breaches of security the 
contracted environment is a no failure approach to 
security issues. That is the security regime we have 
been asked to step up to. Both parties understand 
that no system is foolproof, but in terms of any 
weaknesses that we find in our system, or is found 
through audit, we are contracted to remedy it 
quickly. Any issue where we do not remedy it will be 
a failure by us as a contractor. Therefore, there is not 
a statement which says 10 breaches over a period are 
acceptable; it is a zero tolerance environment. 
Should we find any issues the contracted remedy is 
how fast we respond to it and satisfy the authority 
that we have plugged any hole. 


Q316 Mr Campbell: We will watch that space! 
Professor Randell: When I and colleagues met Mr 
Granger a year ago we were absolutely shocked to 
find that CFH did not have any documents stating 
things like the reliability and security guarantees. 
They said that they did not have them because they 
were regarded as confidential to the suppliers. I still 
find that absolutely gob-smacking. 


Q317 Mr Campbell: That is a good point which we 
will take up. Why are you and your academic 
colleagues so sceptical about the security of the new 
system? Do you think there should be more or 
improved security? I think the answer is yes. 

Professor Randell: Yes, but I do not think that you 
simply add in more security mechanisms. There is a 
question of how well trusted and supported it is by 


the medical profession. A complex system that 
works has been derived from a simple system that 
already works and is already trusted. In a number of 
ways, as a whole, even if not in terms of individual 
hospitals, it is a huge imposed system that is being 
forced into environments some of which see it as 
making them go backwards and replacing systems 
which are in some ways better for their particular 
purposes. That is not the way to get a system where 
the general atmosphere is conducive to trust and 
support for policies other than by achieving one’s 
goals despite the system. I repeat my comment that 
I have great faith in the clinicians to do remarkably 
well for us despite what is being forced on them, and 
I am very glad of it because I have a very strong bias 
in favour of the NHS. 

Mr Hains: Perhaps I may make just make a couple 
of comments without breaching my confidentiality 
agreement with the NHS. It is true that we do not 
have any specific statement on security breaches. We 
have extremely well documented requirements to 
meet on availability, reliability, performance, fix 
time and defects. Clearly, a security breach would be 
a defect. It is also an environment in which there is 
a 100% no data loss requirement. I am pleased to say 
that no data has been lost. We have now deployed 
over 70 systems to trusts all of which have been ona 
voluntary basis. We have laid out our future plans, 
including sealed envelopes. The trusts can decide 
when they jump onto the bus. If a trust has a 
particular feature of its system that it cherishes and 
does not want to join the programme at this stage it 
will not join the programme at this stage. Our 
deployment plans are geared to trusts that 
understand the system. We demonstrate the system 
and help them with the change and they voluntarily 
choose to join the programme as part of their push 
for efficiency as well as the connectivity that it offers. 
There are no strong-arm tactics to have people 
moved to areas of inferior functionality. It is 
absolutely true that these systems are in many ways 
different from the systems that they operate today. 
Change management is involved. We have to 
support both administrative and clinical teams 
through those changes, as in any system change. It 
involves pain on both sides. The fact is that we have 
deployed systems faster than they have ever been 
deployed before and no system has been withdrawn 
once implemented. I believe that we have genuine 
volunteers at the other end, not pressed people. 


Q318 Mr Campbell: How does the failure of the 
Medical Training Application Service square with 
the new system? That was suspended. Is it an entirely 
different system? 

Mr Hains: It is entirely different. I do not believe that 
an attached spreadsheet to a web-based service can 
be compared in any way at all with a fully engineered 
enterprise system. 


Q319 Mr Campbell: But all of the data was in one 
place. 

Mr Hains: Yes, and it did not have role-based access 
or any other controls within it. Clearly, it was a 
seriously flawed way to implement a system. I can 
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describe it only as chalk and cheese in terms of a pre- 
formed database attached to a website compared 
with a properly engineered enterprise system. They 
are absolutely different. 

Professor Randell: Clearly, that was a blunder. The 
trouble is that blunders happen and the greater the 
number of people involved the greater the chances of 
blunders. One way to summarise it is that if you take 
a very complex manual system and computerise it 
the best that you can possibly achieve is fewer but 
bigger failures; the worst is more failures. No payroll 
clerk has ever mailed a cheque for £999,999 and so 
on. In the early days a lot of computers did that. 
When one puts in a very complicated computer 
system one has to write a programme that will deal 
with all the circumstances that one can dream will 
arise. Because one cannot do that successfully there 
will always be the possibility of failures which with 
any luck will not arise too frequently, but they are 
likely to be big ones. 


Q320 Mr Campbell: It is interesting that you say 
that, because Richard Granger also said that if he 
had been in charge of the system it would not have 
happened. 

Professor Randell: To use a famous phrase coined by 
Mandy Rice-Davies, he would say that, wouldn’t 
he? 


Q321 Chairman: Professor Randell, do you say that 
these systems are comparable? 
Professor Randell: Yes, in the sense that all systems 
are liable to have failures because of blunders. That 
is the only comparison I make. 


Q322 Chairman: There is a difference between a 
record brought in effectively for academic purposes 
as opposed to an electronic patient record. It was a 
different system? 

Professor Randell: \t was a very different system. 


Q323 Chairman: One should not confuse the MTAS 
system with the electronic patient record. 

Professor Randell: No, but it does give one reason 
to think. 


Q324 Chairman: | have made the comment that we 
can all go back to the cave and roll a stone over it if 
we want to, but I do not think many of us are up for 
that. Dr Hale, in relation to system dependability we 
heard earlier from Mr Hains that record systems are 
not kept in one place but in different locations. 
Because they are kept in different places and are 
hosted remotely rather than in the hospital or 
practice that uses them it means that potentially they 
will be unavailable if the network goes down or the 
hosting centre loses power, of which CSC has had 
some experience. For how long do you believe it is 
safe for a hospital to lose access to all medical 
records, images and test results that potentially 
would be hosted elsewhere and not in the actual 
building? 

Dr Hale: | can envisage that it may be minutes or 
days. It would depend entirely on the nature of the 
emergency. That is perhaps not a very helpful 


answer, but in acute medicine it would be a very 
short period of time, whereas in psychiatry it would 
be much longer, perhaps a day or so. 


Q325 Chairman: If there was a risk assessment of 
that it would be different in those two 
circumstances? 

Dr Hale: Absolutely. 

Professor Randell: The art of designing an overall 
system like this is to accept that there will be failures 
and to put in an awful lot of planning as to how to 
cope with them, and also to put in an awful lot of 
planning about how to minimise reliance on the 
system. One example that is well known to 
everybody here is the Visa electronic payments 
system which in one sense is incredibly reliable. 
From a detailed study of it however I am aware that 
some very careful thought has gone into minimising 
reliance on any particular part of it, including any 
particular bank. It really is an issue of minimising 
reliance. As to the levels of reliability that can be 
achieved, one of my colleagues who is very much of 
a specialist in this area gave me some rather startling 
statistics, some of which I already knew. The Health 
and Safety Executive is prepared to accept that the 
very simple system, part of a nuclear reactor, the 
shut-down system that is one of the precautions in 
case the reactor overheats and explodes may well fail 
one in 1,000 times it is used. The manufacturers try 
to claim that their method of testing it and so on 
would make it one in 10,000. The HSE was not 
prepared to believe that. It is typical for well run 
systems to be more reliable than they can be 
guaranteed to be a priori. If we take something like 
Microsoft’s Windows operating system it is claimed 
by the company that such a system on average will 
manage to keep on working for just 3,000 hours 
before it fails. That is not a huge amount of time, but 
it is probably a lot better than anybody believes 
because there are so many other things that can go 
wrong. Think how they have managed to achieve 
that: hundreds of thousands, even millions, of 
people have willingly or unwillingly helped 
Microsoft to test it. A one-off system—as far as lam 
concerned NPfIT is a system luckily with a lot of 
architecture and structure to it—which undoubtedly 
is in many ways safety-critical and security-critical, 
hence this session, is very different. The examples 
that I can quote are somewhat similar. Take a very 
modern Ministry of Defence command and control 
system which is a very large networked system. The 
statistics that I have been given reveal that on 
average modern command and control systems 
suffer one failure every 40 days and a dangerous one 
every five months. Another sort of system which is 
reminiscent of NPfIT though not in size is a big 
process control system. That is the sort of thing 
which will be employed in a huge oil refinery to 
collect data from thousands of places. A process 
control engineer will say that as a rule of thumb one 
can fear that such a system will fail completely about 
once every two years. My specialist friend has done 
a lot of work on estimating failures. As a 
guesstimate, not estimate, he said that NPfIT would 
be likely to fail about once every four days. He said 


Ev 62. The Electronic Patient Record: Evidence 


ee eer ean ene Poe TV TOT nESnEDEnP NOESY nn SETS en EER 
10 May 2007. Mr Guy Hains, Professor Brian Randell and Dr Rob Hale 


that his method of giving a scientific estimate would 
involve being privy to trials of NPfIT as a whole over 
a reasonable period—I believe he was talking of 
weeks or months—and being given details of how 
many different faults were found during that trial. 
He has a well established method to come up with a 
conservative estimate for reliability. | was shocked 
by those numbers, but it seems to me that there are 
all sorts of technologies and expertise that 
Connecting for Health could well be asked to 
investigate so we have less in the way of anecdote 
and more in the way of facts. Apparently, there are 
facts as to what the rules are with respect to 
reliability but they are not out in the open. Why 
should we trust them? 


Q326 Chairman: Mr Hains, what lessons did you 
learn from the Maidstone data centre incident last 
year, and what was the effect of it in terms of what it 
was hosting and the establishments involved in it? 

Mr Hains: The regime to which we are working with 
NPfIT is a very rigorous set of severity measures for 
any problems that we may have. Those are geared to 
requirements rather than any measure of an outage 
time or whatever. To give an example, if there is only 
one printer and it is not available at a critical clinic 
it can be a very serious matter for the people 
involved. We have a measurement from severity one 
through five and those are catalogued. We have a 
statistical basis on which to assess how well our 
systems are doing. As to the general point in relation 
to our obligations, before we leave a site and 
implement a system with a trust we must develop 
with them business continuity plans which will 
involve descriptions and the testing of what in most 
cases will be manual procedures in the event that the 
system is unavailable. Our job is not done unless we 
have worked with a trust to agree how it will cope if 
systems are wholly or in part not available. Regular 
routines like the printing off of tomorrow’s 
appointments and matters that could cause 
congestion in the hospital are things that are 
absolutely considered in terms of the future 
reliability of the environments. To go back to 
Maidstone, I believe that the biggest risk in the 
computer industry generally at the moment is 
unreliable power supply. Generally across the world 
power has become more spiky which is ruinous to 
any sort of IT system. Last year we experienced a 
power issue at Maidstone which caused a short in 
our configuration there. It set up a position within a 
storage device that required experts to come from 
Japan effectively to reset that system. We transferred 
the operation between our Maidstone centre and the 
reserve centre which was effected without data loss, 
as was the pass back to the primary data site some 
weeks later. We learnt several things from that. 
First, we learnt that as we scale up the system it is 
better to have four centres than two, which is what 
we have invested in, so that data is now not only 
mirrored but effectively held simultaneously in two 
places. We are holding that across four centres, not 
just two. Second, out of that experience with the 
authority we have tightened our targets and 
expectations of how quickly systems need to be 


brought up. There was a category of systems which 
were deemed not to be critical—they were non-acute 
and departmental-type systems—and there was a 
fairly leisurely take-up. As Dr Hale said, some 
systems can come up much later. The view was that 
72 hours would have been acceptable for that. We 
have now set a new timetable which says that in any 
failure of these systems the expectation is one of 24 
hours and, within critical environments, clearly a 
much shorter time is expected. We have learnt from 
that. We have increased our investment in multiple 
centres and have worked with the authority to re- 
evaluate those levels of acceptability in bringing up 
systems. Just to confirm it, our job is not done unless 
we have also defined contingency and manual 
procedures. 


Q327 Chairman: | believe that it affected about 72 
Primary Care Trusts and eight hospitals which 
suffered a loss of data for that period of time. 

Mr Hains: There was no loss of data; it was loss of 
availability. 


Q328 Chairman: They were unable to get hold of the 
data for a time. Were there any clinical implications 
of which you are aware? 

Mr Hains: No. Clearly, there was an administrative 
implication. With our staff who have security 
clearance to help with administration we went out 
and paid for additional administration support. 
Therefore, the pain was administrative. We have no 
evidence of clinical risk or data loss, and it was 
inconvenience for which we are really sorry. Our 
remedy has been the further investment we have 
made regarding setting up a much more resilient 
environment. 


Q329 Dr Taylor: Professor Randell, in your written 
submission in heavy type we see the very definite 
view that “a detailed constructive review of NPfIT in 
the light of these insights could, we argue, greatly 
increase the likelihood of the project’s eventual 
success.” Can you justify that to us in the remaining 
two minutes? Obviously, you want one of our 
recommendations to be that there must be an 
independent technical review. 

Professor Randell: The quickest answer is that there 
have been so many cases in the past of other systems 
that have benefited from such a review. One of my 
colleagues who testified to you earlier, Professor 
Martyn Thomas, has himself been involved in quite 
a number of such reviews. I have not. We are talking 
about a constructive and detailed technical and 
socio-technical, if I may use that term, review which 
would work with Connecting for Health and be 
imbedded in it. That would be of considerable help. 


Q330 Dr Taylor: Would that be feasible at this time 
in the process? 

Professor Randell: | believe so, because I think there 
is a way effectively of turning the whole programme 
round based on the number of good things that the 
programme is already doing and into a programme 
where there is authority as well as responsibility at 
the trust level and where the LSPs act as services 
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rather than as controllers. That could have a big 
effect on lots of the attitudes and worries that we 
have found extensively documented. One has here 
not just a technical problem where one big further 
heave will convince everybody; one has a big social 
problem to convince a lot of people that it is worth 
going on with the programme. I think that it is, but 
we must first change an important aspect of it. 

Mr Hains: We have collaborated with the many 
reviews, both commercial and technical, that have 
already been done on the programme. The way that 
our company operates is that this is reviewed by 
colleagues from the United States and Australia and 
by other healthcare experts. That review effectively 
is at each key design phase and is no longer than 
every two months. Within our worldwide 
organisation there is constant quality and 
fundamental design review, particularly as it relates 
to performance and scalability. Today I have talked 
a bit about some of the myths that we come across 
regarding how this system is configured and the 
degree to which there is fear that in some way it is 
monolithic. We can only chip away at those issues. I 
should like to confirm that we are investigating that. 
Last week across the way in the QEII Centre we 
talked openly to several hundred nurses about some 
of the issues that we have referred to today, for 
example how the systems are used and how some of 
the policies relate to them but also making real 


demonstrations of the systems, frankly to take some 
of the fear out of what is coming and the level of 
change. I agree with Professor Randell. In terms of 
our architecture, we are very confident that those 
good design principles have been deployed but we 
then need to invest jointly in externalising that 
message. That can only speed the take up and 
smooth implementation. We are making those 
investments and have had a very good response. 


Q331 Dr Taylor: Does that reassure you somewhat? 
Professor Randell: The sort of review I was talking 
about was one that was visibly independent, open 
and public in order to fulfil its role of helping to gain 
trust. I absolutely agree with Mr Hains on the 
importance of internal reviews, but I was talking of 
something rather different. 


Q332 Dr Taylor: Is it possible to have a note on one 
or two of the technica! reviews to which you referred 
that have taken place and the results of them? 
Professor Randell: Yes. 

Chairman: I thank all of you very much for coming 
along. I am sorry for the lateness of the hour. We 
have finished half an hour earlier than our previous 
session on this subject. I hope we can improve on 
that by another half an hour the next time we take 
evidence. 
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Q333 Chairman: Good morning and welcome to the 
third evidence session of our inquiry into electronic 
patient records. I wonder if I could ask you, for the 
record, to give us your name and the position you 
hold. 

Professor Dezateux: 1 am Carol Dezateux. I am 
paediatrician by training. I am a professor of 
paediatric epidemiology at the Institute of Child 
Health and an honorary consultant paediatrician at 
Great Ormond Street NHS Trust. 

Dr Walport: 1 am Mark Walport. I am the Director 
of the Wellcome Trust. In a previous life, I was a 
professor of medicine at Hammersmith Hospital, at 
Imperial College. Iam a member of the board of the 
UK Clinical Research Collaboration and of the 
Interim Board of the Office of Strategic 
Coordination of Health Research (OSCHR). 
Professor Wessely: | am Simon Wessely. I am a 
professor of psychological medicine at the Institute 
of Psychiatry at King’s College London. I am also 
here for the Academy of Medical Sciences. 


Q334 Thank you very much and, again, welcome. In 
broad terms, what benefits can the Secondary Uses 
Service bring to research in the United Kingdom and 
what potential do you see in the electronic patient 
record once it is more widely used? 

Dr Walport: This is all about improving patient care. 
Good patient care depends on having good medical 
records. As an example, Choose and Book is 
something that has been introduced as an early 
phase of the National Programme for IT but how 
can you Choose and Book if you do not know what 
the benefits of seeing different individuals are? That 
requires good data. Frankly, having good healthcare 
depends on doing research all the time. It is a 
question of raising the game. I think research is 
completely integral to good patient care and 
electronic patient records are a very powerful way of 
achieving that. 

Professor Wessely: We would agree completely. It is 
an ability to use the enormous data resource of the 
NHS for the public good in a way that has not been 
possible before. It can answer questions swiftly and 
accurately on patient safety. Issues such as MMR 
and autism could have been dealt with very swiftly 
and properly. The whole range of opportunities that 
it provides, we welcome. We feel it will amazingly 
improve the effectiveness of the NHS and patient 
safety. 


Professor Dezateux: | would like to add to that. 
Thank you for this opportunity to raise the profile of 
research using electronic health records. I was a 
doctor trained in the NHS. Nye Bevan established a 
health service free at the point of use but the other 
very important person from my generation was 
Archie Cochrane who emphasised the need for 
effective healthcare free at the point of use. England 
is renowned for initiating the international 
Cochrane Collaboration which pulls together 
evidence in an accessible form to inform effective 
healthcare. For my generation there is no distinction 
to be made between health services and research for 
effective health services. Coming as I do from a 
public health background it is really important that 
we understand how to protect the health of the 
public when we are dealing with a much more 
complex environment where public health concerns 
require rapid answers. Without an infrastructure 
built on electronic health records we cannot 
discharge that public duty effectively. I think it is 
very important that we get over, using some detailed 
examples, the important questions that we will not 
be able to address if we do not have this kind of 
opportunity in the UK. 


Q335 Chairman: A number of witnesses described 
access to the national electronic record data as a 
“unique selling point” for research UK. What is 
your interpretation of a “unique selling point” and 
do you agree with that? 

Professor Dezateux: There is indeed a unique 
opportunity in the UK, based on the fact that we 
have a National Health Service, we have a diverse, 
large population, and we have the opportunities 
through our public services and our public 
infrastructures to understand and identify reliably 
effective treatments and also reliably to identify 
causes of disease. While there are other countries 
that have developed their electronic record linkage, 
notably the Nordic countries and Western Australia 
and some parts of Canada, in general we have a very 
long and distinguished tradition of using electronic 
records in the UK and we rather take for granted, in 
fact, the ability to link to vital events, the ability to 
link to cancer registers, but we have to remember 
that some of the most important health 
discoveries—the link between smoking and lung 
cancer, ef cetera—were all facilitated by these 
opportunities. 
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Dr Walport: The greatest advances in health have 
come from public health measures, going back to the 
discovery by John Snow in the 19" century that 
which water pump you took your water from 
influenced whether you got cholera or not. The 
opportunity in England to have potentially 50 
million health records with good record linkage 
offers enormously important opportunities for 
improving patient health. Let me take another 
specific example. Drug trials, before a drug is 
released, offer the opportunities to find out the 
potential benefits and side effects in populations of 
a small number of thousands of individuals, but the 
truth is that drugs that are effective also have side 
effects and if you want to find the rare side effects 
then it is important that you can find them when you 
are looking at large populations. So, again, the 
opportunity to have good record linkage for a 
population of 50 million means that you can 
potentially find rare and uncommon side effects of 
drugs quickly. For example, the association between 
some of the new non-steroidal anti-inflammatory 
drugs such as Vioxx and cardiovascular disease 
would, I think, have been discovered much more 
quickly if there had been very good electronic 
patient records and very good epidemiology 
surveillance of that. This is all about good health 
actually. 

Professor Wessely: Researchers from my institution 
routinely go to other nations with systems, namely 
the Nordic countries, to do research that we cannot 
do in the UK. They are just in the middle of looking 
at a study on maternal health and schizophrenia in 
children that can only be done in Denmark and 
Finland because that is the only way you can assess 
related events during pregnancy to the later outcome 
of schizophrenia in the child. I think most people 
would agree that is incredibly important. We cannot 
do that in the UK. We have someone who has had 
to be taught Finnish to go and do these studies in 
Helsinki. Obviously the data here would be much 
better, because it is much bigger and more 
comprehensive. 

Professor Dezateux: There has been a _ huge 
investment in the human genome project and this 
country has terrific resource in terms of some large- 
scale cohort studies linked to biological data. To 
exploit that and the knowledge and understanding 
that will lead from that, we really need to capitalise 
on these opportunities for record linkage to 
understand the meaning of the genetic changes for 
future health and to advise the health services wisely 
about how to use these tests in the future. I think the 
UK is very uniquely positioned to do that. Already 
there have been some very important advances 
building on that and we would like to see that 
opportunity developed more because we have the 
opportunity, both in the pharmaceutical industry 
and in terms of the discovery of causes of disease, to 
be a world-class leader in the UK in that way. This 
is really what this will allow us to do. 

Dr Walport: Indeed, it is timely, because the front 
page of The Independent today and the lead story on 
the News at Ten last night was a report of an 
enormous study of genetics of common disease 


demonstrating new genes for Crohn’s disease and 
diabetes, and in the last few weeks there have been 
new common genes associated with obesity. These 
have all benefited from very good cohort studies 
carried out in the UK. 


Q336 Chairman: The initial aim of setting up the 
Secondary Uses Services was really a way of 
performance management and payment by results. 
Do you think Connecting for Health was very slow 
to recognise the potential for research? 

Dr Walport: | think it is getting there. The very term 
“Secondary Uses” is unfortunate because it seems to 
me that one of the primary uses of Connecting for 
Health should, for example, be providing expert 
systems to help doctors and other health 
practitioners in diagnosis and treatment. I think this 
should be a primary use. It comes back to the point 
I made earlier. How is it important, as it were, to be 
able to choose between five different clinics and five 
different doctors if you do not know anything other 
than waiting times? 

Professor Wessely: 1 quite agree. In thel1948 NHS 
Act research was defined as a primary function of the 
NHS and I think it is unfortunate they have chosen 
the term “Secondary Uses Service”. However, we do 
have some concerns on the technical side. To do 
these kinds of studies takes an enormous amount of 
expertise, time, and trouble—to do the validation, to 
do the linkages, to make sure they are accurate and 
so on. We have some concerns that the Secondary 
Uses Service, so called, has that ability or expertise 
or commitment at the moment. That is something 
that needs to be looked at carefully. 

Professor Dezateux: | think Connecting for Health 
have been very focused on delivering performance 
management and business and have been instructed 
to do so. However, our experience over the 
simulation exercise that was carried out for the UK 
Clinical Research Collaboration was a very good co- 
working in openness with those involved in the 
Secondary Uses Service, with good receptivity really 
to the opportunities that this provides, so I hope we 
can move forward positively, building on this 
dialogue rather than perhaps perseverate about the 
past. 

Dr Walport: | think: that is exactly right. I think the 
direction of travel is right; there now is a recognition 
in Connecting for Health that research does matter. 
It is very instructive to look at other countries and 
other systems. If one looks north of the border in 
Scotland they have extremely good electronic 
patient records, particularly in areas such as 
diabetes. We recently held a meeting at the 
Wellcome Trust on behalf of the UK Clinical 
Research Collaboration and had presentations from 
two of the big American systems; from the US 
Veterans Administration, with many millions of 
patient care records, and from Partners Healthcare 
System in Boston, where, again, they have more than 
two million records. It is quite instructive that in all 
of those environments they are using them very 
effectively. I think this will get much _ better 
acceptance when the medical profession at large can 
see it is enabling the profession to do its work better, 
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and that is why, in a sense, I think focusing on the 
management side meant there was much less 
ownership of the system by the people who had most 
to gain from it. 


Q337 Chairman: Carol, you recently took part in a 
study to simulate the impact of electronic record 
data on different kinds of research. What were the 
main findings of the study? 

Professor Dezateux: There were four groups, of 
which I led one, each of which looked in different 
ways at different types of study designs, ranging 
from clinical trials to issues about patient safety to 
issues about causes of disease. We led our groups in 
parallel but with a lot of cross-working. The first 
thing to say is that we were all convinced that there 
were fantastic strengths in the UK in record linkage 
and that the opportunities with a largely electronic 
general practice now, with increasing use of digital 
information and electronic information in hospitals, 
needed to be built on, but we looked internationally 
at leading examples and we felt that political 
leadership was critical to this. I think we all signed 
up to that. We felt there was strong consensus across 
the four areas. The first is identifying patients 
reliably across these different data sources. We know 
from the Nordic countries and from Scotland that 
having a single patient identifier is the most critical 
factor and mandating its use in all health service 
encounters reaps enormous benefits. That is the key 
to the successes in the other countries and where 
Scotland is ahead of England in this respect. We 
need to link in all NHS encounters, so the Secondary 
Uses Services needs to engage proactively the 
primary care pathology services and, indeed, the 
private sector. Some of my own interests in assisted 
reproduction—which is a topical issue at the 
moment for Parliament—show that we have had, 
since 1990, a database of more than 1.5 million 
cycles of treatment. Currently we can link that to 
nothing. We have learned very little about the long- 
term effects for mothers and children of assisted 
reproduction in this country yet there are major 
public safety issues related to that. We must have 
this ability to link. We should not have data sets that 
are not patient-level and that are not linkable, 
because we cannot answer the important questions 
that society wants us to address. Following from 
that, we were all agreed that we needed person-level 
data. I can give you many detailed examples that 
show why that is the case and I think this is probably 
an important point to get across. We want the legacy 
data—which means we want the data that goes back 
many years—because one of the important things is 
the ability to answer questions rapidly and not have 
to wait to accrue lots of person-years of observation 
to answer these questions. We need the full 
demographic record, particularly if we are interested 
in, for example, environmental exposures relevant to 
chronic disease, to asthma, to obesity—these really 
important public health problems that we are going 
to address. For some opportunities we need real- 
time access to the data. Clinical trials are an 
important way to provide reliable evidence about 
effective treatments. One of the obstacles to 


delivering those trials in a timely way is that 
recruitment is low or there are not eligible 
populations, so we need to be able to look into these 
data sets and say: “How many people are there out 
there with these kinds of problems who would be 
potentially willing to receive an invitation to take 
part in research?” At the moment it is very, very 
difficult even to send that invitation to anyone, so we 
need a “can do” culture shift that allows us to do that 
but which does not compromise the governance and 
confidentiality that we all obviously respect. Those 
points were very common. For the kind of public 
protection, health protection issues, we cannot 
invent these infrastructures as the questions arise. 
This is why we need leadership. We cannot think 
that somebody is going to come up with an idea 
about MMR and autism, or somebody is going to 
think about fire retardants and cot death, or 
somebody is going to think about pesticides and 
mal-development of the eye in children. I can 
produce endless examples of public health concerns 
where, in order to answer things rapidly, we need an 
infrastructure such as there is in the Nordic 
countries where we can look at reliable data and say, 
“Is there any evidence to support this concern?” If 
there is: “What kind of more detailed studies should 
we commission to drill down into this?” We cannot 
take that first step very easily in this country. I 
chaired the MRC group looking at the epidemiology 
of causes in autism. The fastest study came from 
Denmark. Using data for some two million person- 
years, they were able to look at children who did and 
did not have MMR, link them to autism registers, 
birth registers, and conduct and report a fantastic 
study in The Lancet. It took us four years to do that 
in the UK. That is the kind of advantage. Very 
finally: it is communication, communication, 
communication. That is the other big conclusion 
from the simulations. We need to get out there and 
work with Connecting for Health, to get over these 
narratives that make it clear to health professionals 
and the public what the benefits are and what the 
implications are of opting out or withdrawing from 
this collective good, if you like, the ability to answer 
important questions conclusively. 


Q338 Chairman: What did your particular study find 
in terms of the accuracy of data and also the issue of 
the standardised form? 

Professor Dezateux: The first thing to say, as a 
paediatrician, is that one of the outstanding 
successes has been the introduction of the NHS 
numbers for babies in 2002 by Connecting for 
Health. This has enormous potential for us because 
we have a unique identifier early on. We would like 
to be able to link mothers to their babies and we 
would like to be able to link siblings to their siblings 
because some of the questions that we have are 
around families. There is not a mandated system for 
doing that but it is not a technically challenging or 
difficult to do, given the right leadership and the 
right go-ahead. There are many examples where 
there are certain elements of data that are either not 
routinely collected or where the quality could be 
improved. I think we need to understand that this is 
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a process. By linking research to clinical practice and 
embedding this in clinical communities, which is 
what Scotland has done, there is this constant 
interchange that research looks and helps us to 
understand the quality of the information and 
provides solutions about improving that quality. If 
the quality serves both clinical care and research, it 
is a win-win situation. There are interoperable 
standards, there are technical solutions to this 
coming out. I do not think those are major obstacles; 
I think it is the leadership and the political will to 
make these things happen that is the most crucial 
thing from our perspective. 

Dr Walport: Could I pick up five points very briefly 
from Carol’s answer. The first is the unique 
identifier. It is absolutely critical, but it is absolutely 
critical for clinical care as well. If your name is, let us 
say, Dr Richard Taylor, there is probably more than 
one Richard Taylor in the UK. 


Q339 Sandra Gidley: Has there not always been a 
number? I have had an NHS number for years. 
Dr Walport: But it is not regularly used. 


Q340 Sandra Gidley: Why do you need a new one? 
You just need to use the old one. 

Dr Walport: One needs a number that is recognised 
and used, but it is not used. That is a problem that 
has been cracked in Scotland. It sounds trivial but 
implementing that is a difficult thing to do. That is 
the first point. The second point is that Carol has 
illustrated many examples where it would not be 
possible to get consent in advance because you do 
not know what you are always looking for. The third 
point is you do need patient-level data. The fourth 
point is that actually the identity of the individual is 
of no interest to the researcher whatsoever; therefore 
the solution for this is something which is called 
pseudonymisation, where basically you strip the 
links— 


Q341 Chairman: We are going to ask you questions 
about that later. 
Dr Walport: 1 will come back to that then. 


Q342 Dr Taylor: You have rather floored me 
because you have pretty well answered all the things 
I was sort of scheduled to ask. You have made it 
quite clear that “Secondary Uses” is the wrong title 
because research is absolutely integral to the 
improvement of clinical care, so that is crucial. The 
thing that bothers me is the widespread nature of the 
availability of recordkeeping when we, do go 
electronic. Richard Granger takes great pleasure in 
showing us photographs of medical records 
departments at the moment, which are huge areas 
stuffed with notes but where nobody can ever find 
what they are looking for. There is a huge problem 
with the tremendously easy availability, when it 
comes, of a vast horde of information. There are 
practical points. We are delving into the Summary 
Care Record and the Detailed Care Record, will 
those be things to which you expect to have access? 


Professor Wessely: First of all, you are quite right, at 
the moment we have a situation where you cannot 
get records when you need them but it is dead easy 
to find piles of records left lying around in surgeries 
and hospitals. In terms of security, we have to 
remember that it was not a golden age before, where 
doctors held notes clutched to their chests 24 hours 
a day. That is just not true, as I am sure you 
remember. On the second point, I think it depends 
on the questions you are asking but, ultimately, if the 
data, for example, can be anonymised, I do not see 
there should be any restrictions on what data should 
be available. It is always a tragedy to lose data. If we 
look at the issue, for example, of postcode, which is 
semi-identifiable, if you strip postcodes you cannot 
answer any questions on social differential or 
geographical access. Huge things then disappear 
from the agenda. I think there should be a very 
careful discussion if any data is not going to be 
available, subject to all the checks, balances and 
procedures that we are expecting to be in place. 

Dr Walport: | agree with that completely. Again, this 
is about clinical care: the availability of the same set 
of records in general practice, in hospital, when 
someone moves from one clinic to another. Clinical 
practice at Hammersmith was transformed when in 
the early 1990s we had a digital system for X-rays. 
Suddenly an X-ray was available: you could look at 
it in your clinics at the same time as a radiologist was 
looking at it in their office. It made patient care 
better. The corollary of that is of course that you do 
need good governance. I think we are talking here 
about good governance but, in a sense, the greatest 
risk to confidentiality is the closer you get to the 
patient: it is at the point of primary care, it is in the 
local hospital. That is where there is the greatest 
danger of inappropriate availability of information 
to people in the neighbourhood. In the context of 
research, as I say, the researcher is not interested in 
the identify to the individuals per se but this does 
need good governance. Things can go wrong 
electronically, as indeed they did when records were 
found on tips at the back of Harley Street many 
years ago—quite sensitive medical records, I seem 
to recall. 

Professor Wessely: To amplify that, when you look 
at what has happened with leakage of information— 
and when we wrote the report for the Academy we 
took a lot of evidence from various sources, 
including the Information Commissioner—in the 
research communities there have not been any cases 
of which the Information Commissioner was aware. 
There had been no complaints about the use of 
leakage of personal data from research. There had 
been numerous complaints about the leakage of 
personal data in medical care, that is true, and of 
course there are gross instances of research 
misconduct, that is true as well, but in terms of 
public health and epidemiology and confidential 
information, for that misuse he said they had had no 
complaints, and we were not able to find examples of 
where that had happened. That is not to say it will 
not happen in the future but it is not a major 
problem and it has not yet been recorded 
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Q343 Dr Taylor: Will leakage not be much easier 
from an electronic system than a paper system? 
Professor Wessely: 1 am not a technology expert but 
I personally would prefer that. Having seen what 
happened during my lifetime as a doctor and having 
seen the way in which records are stored in all sorts 
of settings, Iam more confident about new systems. 
In the new system there will be an electronic trace 
and the most serious sanctions for people who 
violate that. At the moment, often you will not 
know. 

Professor Dezateux: 1 would endorse all those 
points. I think we need to put boundaries around 
these concerns because availability does not mean 
open access. We need to have visible to the public 
and health professionals the governance framework 
that informs the access. When I started out in 
medical research, I could do exactly what Simon 
said. I ran a study in general practice and I could go 
and pull out the Lloyd George envelope and read 
everything that was in there if I wanted but I was 
only interested in a small bit of it. The difference now 
is that there is an electronic record and I can say, 
“Give me these data items. That is what I need to 
know, I am not really interested in the rest” and I can 
have an audit trail which shows what I, as a 
researcher, have done with that and which holds me 
accountable. I would lose my job if I did something 
wrong. I think you have to have those sanctions. I 
would like to give you one example, if I may, of HIV 
surveillance. I think these issues address very 
sensitive data where perhaps you would not want to 
go back to individuals to ask them questions but you 
can still answer important questions using records. 
When HIV first emerged as a disease, the risk of a 
mother who was infected infecting her baby was one 
in five. Now that risk is less than one in 50. One of the 
reasons in the last 15 years that there has been this 
dramatic improvement has been not just effective 
treatments but our understanding of the time/ 
person/place distribution of HIV. We do that using 
the leftover blood spots from newborn screening 
which reflect the mother’s antibody status and those 
are tested anonymously. Since the late 1990s they 
have been linked to some information at birth 
registration using the secure system. We have this 
information now, over the years, of more than two 
million babies and their mothers. This helps us 
because we have no biases: we do not socially 
exclude the populations that are HIV positive. We 
understand how the epidemic has changed. It has 
informed antenatal screening, which is one of the big 
pillars of effective prevention, and it shows us now in 
the Health Service how effective that system is. So it 
moved from being research to public policy to health 
service and evaluation, and you would be hard 
pushed to put a line down and to say where research 
becomes clinical practice. In all the years we have 
done this, we have an honest third-party broker that 
does this. The laboratory in my hospital sends 
information to the Office of National Statistics, they 
link the data, they remove the identifiers, and only 
then can the laboratory test the samples, when all 
this has been removed, so that it is very secure. In all 
the years that that testing has been carried out for 


the Health Protection Agency, there has not been a 
single episode of disclosure or breach of patient 
confidentiality. That is an outstanding success and 
we need more systems like that, with clarity for 
researchers and health professionals and parents 
alike as to where to go for that information. I am 
sorry for the detail but I think these examples are 
very powerful. 


Q344 Dr Taylor: Going on a slightly different tack, 
it has been suggested to us that even the police when 
they are investigating terrorism have only limited 
access to medical records. Why should researchers 
be given easier access than the police under those 
extreme circumstances? 

Professor Wessely: 1 think you just need to ask the 
general public which they would prefer. It is fairly 
clear that these are totally, radically different things. 
Research is part of the function of the NHS; the 
prevention of terrorism is not. If you want the NHS 
to improve and to deliver good care, if you want to 
find out not who is planting bombs on the subway 
but if living near a power station causes cancer in 
your children, you need there to be a powerful 
epidemiologically based public health framework 
for research. They are just utterly, radically 
different. 


Q345 Dr Taylor: So we would have the public on 
our side. 

Professor Wessely: 1 would hope so. In fact the 
evidence shows very clearly that they are. 

Professor Dezateux: It also lies in the issues that the 
police are interested in individuals and the mistrust 
is that it is going to be used to nail an individual 
falsely and that there is an error there. You have to 
remember that in most of this we are not interested 
in who those people are; we are interested in groups 
of people but we need to link their information at an 
individual level in order not to make terribly 
misleading conclusions from research. That is why 
we need the individual linkage. Beyond that, we are 
not interested in the individual. 

Professor Wessely: Around the polonium incident, 
we did a study with H Payne looking at who did 
people trust to manage it. Fortunately, doctors and 
scientists were top of the list and the police were 
quite low. I think people are able to detect 
differences. 


Q346 Dr Taylor: In your submission, Simon, you 
were very keen to distinguish between what you 
called bona fide secondary users of the data by 
researchers and other users who might be insurers or 
the media. 

Professor Wessely: The access is within what is 
sometimes called the NHS family, which includes 
medical researchers, people who have similar 
obligations of confidentiality. For example, we 
cannot do anything without an ethics committee 
approving what we do. That certainly does not apply 
to the police or the insurance industry. The research 
we do has to have some public interest in doing it. It 
has to be governed by our own research governance 
arrangements. It has to be governed by our own 
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Caldicott Guardians. Within the system, there is this 
very complicated system of checks and balances by 
which we have to be governed. If we do not observe 
that we are in deep, deep trouble and it is the end of 
a job. I cannot simply say, “Give me the data” on 
this that or the other, I have to apply to an ethics 
committee, a Caldicott committee, and R&D 
committee and so on. 


Q347 Dr Taylor: Do you think ethics committees are 
going to be overwhelmed? 

Professor Wessely: | do not think any more than 
they are now. 


Q348 Dr Taylor: You do not think this will lead to 
an explosion. 

Professor Wessely: | would think it will almost do 
the opposite because you might be able to do bigger 
and better studies that definitively answer questions 
instead of lots of small things that are inconclusive. 


Q349 Dr Naysmith: All three of you have obviously 
come along very well prepared because you have 
already answered many of our questions, as Richard 
said. Could I pursue a little bit more the patient 
consent systems and the confidentiality aspects. 
That is something that may not worry medical 
researchers too much but I know we take it seriously. 
Dr Walport: It does worry me. 


Q350 Dr Naysmith: Some witnesses have expressed 
some very strange fears to us already. What do you 
think of the current systems for protecting the 
confidentiality of patient data that is used for 
research, and you have outlined some of them 
already? 

Dr Walport: Confidentiality is extremely important. 
I do not think anyone should doubt that. I think that 
is an issue that ethics committees have always taken 
extremely seriously. The issue then is about consent 
and where consent is appropriate, and also what you 
do to maximise the confidentiality in the sense that, 
as I said before and as Carol has illustrated, one 
needs patient-level data but one does not need the 
name of the individual. Therefore, I think the 
principle of research should be that one should strip 
away as much identifying information as you can, 
recognising that if you want to find an association 
between something in the environment, for example, 
an electronic power line ora tip, then you might need 
to have geographical information which if someone 
were sufficiently obsessive they could dig out but you 
would have to do that. I think that is where 
pseudonymisation comes in. The principle there is 
that you strip out as much as you possibly, can but 
the whole point about pseudonymisation is that 
ultimately someone is able to link the record to the 
identity of the individual. One has to recognise that 
it is not perfect, in the sense that it is not absolutely 
impossible to get back to the individual. Under some 
types of research, it may be, but under others, where 
it comes down to postcode-level information, 
someone who is determined could do it but they 
would be breaking the law, they would be breaking 
the regulations, the ethics. 


Q351 Dr Naysmith: How difficult is it, do you think, 
to strike the right balance between the needs of 
researchers and patients’ rights to _ privacy? 
Remember that some of these patients may have 
fears that they need to have assuaged by the 
researchers. 

Dr Walport: If you asked the patients—and I think 
that is an important thing to do—patient response is 
overwhelmingly favourable for this. Cancer 
Research UK did a study in patients with cancer 
about their views on cancer registries and the results 
were extremely supportive down to identifiable 
information. 


Q352 Dr Naysmith: We have had information that 
people who have had recent experience of the 
National Health Service think it is wonderful but 
those who just read about it in the newspapers think 
it is on its knees, as the BMA said yesterday. It is the 
people who are not currently engaged with their data 
being used for research, such as cancer patients, and 
who read about it in The Daily Mail who need to be 
reassured that things are all right. 

Dr Walport: 1 agree with that completely. That 
returns to Carol’s point about communication. I 
think it is extremely important that we do explain 
how data is used and the systems of protection that 
are there. It is absolutely critical that this is all 
underpinned by good governance, that the data is 
held, that there is, as it were, an electronic trace of 
when records are accessed, but it is very important to 
distinguish that from a requirement for consent for 
things when, in truth, it is not possible to gain 
consent, nor is it even appropriate in the context of 
clinical care. I will give you an example. There was a 
hospital which produced a very detailed consent 
form for surgery—two pages of pretty small print. 
On the back of it was a little tick box which said “I 
understand that my tissue may be used for 
unspecified essential research in the future.” If you 
are admitted to hospital in the middle of the night 
and you require emergency surgery, then the issue 
here is proportionality. You want to know what the 
operation is, who is going to do it, what the risks are, 
how long it is going to take to recover. The last thing 
you want to do or indeed the doctor, who is tired 
from taking consent potentially, is going to want to 
do is to then go into a detailed explanation of 
potential uses for research in the future. I think we 
really have to strike a balance between issues of 
consent and confidentiality. What really matters is 
confidentiality and that has to be maintained by, 
wherever possible, stripping out identifiers but 
recognising that it is not always possible to do that, 
and on the other hand providing best generic 
information through advertisements in surgeries 
and hospitals that this type of research happens. 
Professor Dezateux: | think it is a question of 
balance but underlying this is public trust. The 
balance that we need to strike is between the greater 
public good that will be served by being able to 
answer these questions and individual rights. There 
has been an immediate jumping to the idea that 
individual consent is the way forward. Many people 
such as Onora O’Neill in her Reith Lectures have 
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highlighted these issues. In working with a range of 
publics, from parent support groups for children 
with rare disorders, congenital disorders, to the 
publics that are all offered newborn screening, for 
example, for their child, our experience is that they 
want to know that there is a safe and secure and 
transparent system with sanctions. They do not 
necessarily, as Mark has said, want to be burdened 
by specific and general consents that are poorly 
understood. The implications of that are that you 
exclude sections of the population if you do that. We 
have a number of studies now looking at general 
population consents that show that socially 
disadvantaged and ethnic minority groups are not 
consenting to the same degree. You could argue this 
is lack of trust but we could also argue this is the 
bigger challenge of communicating effectively what 
we are trying to get at and we would say: “Where is 
the evidence about health in these marginalised 
groups? Where will we be if we have not collected 
it?” The example that strikes at the heart for every 
paediatrician is the Bristol inquiry. There is a quote 
from the mother in the Bristol inquiry which is 
almost tearful to read, criticising the idea of a 30 day 
post-operative mortality as the outcome of research. 
She wants to know: When her child grows up will 
they be able to go to school normally? Will they be 
able to have normal relationships, families of their 
own? We can answer none of those questions. It is 
extremely difficult to get individual consent and 
follow up those individuals, but with record linkage 
we could have some information on the table for 
families that really matters and informs their 
decision making. I do think this raises a point: we are 
talking about the NHS family of data sets but, as a 
paediatrician in Every Child Matters, we know very 
well that we want to understand about educational 
data, we want to understand about social service 
data, we might want to look at future employment 
for some of these life-course questions. We do have 
the potential to be able to do that and we need to 
understand that the Secondary Uses Service is one 
facet of that opportunity but not the only one. I do 
want to introduce this point, because we are focusing 
very much on health services but, from where I 
stand, I am interested in children in terms of the 
adults they will become, and therefore we need this 
wider vision of health. 


Q353 Dr Naysmith: I would like to put something to 
Professor Wessely. Within the evidence that was 
submitted by the Academy it says, “Research is 
increasingly inhibited by inappropriate constraints 
on the use of personal health data”. How do you 
justify that statement and could it not be seen as a 
little bit cavalier and perhaps a touch arrogant as 
well. 

Professor Wessely: | do not think so. We justified 
that because that was the evidence that we heard 
from many, many parties. The biggest single thing, I 
think, was lack of knowledge of the legal framework 
that permits research to go ahead. There is already, 
as I think Harry Cayton explained, a system in this 
country, a very complicated system, of checks and 
balances and a legal framework that balances off the 


invasion of privacy (for example, from releasing a 
name and address to a researcher to contact them) 
with the public benefit that may come from that 
research. But there are certainly some people who 
hold data who are not aware of these systems, they 
are not aware of the legal protections and the way in 
which the system works. In particular, we heard time 
and time again, often at a local level, of people 
saying, “No, you can’t do this” and quoting the 
Data Protection Act wrongly. Actually the Data 
Protection Act is a very sensible, albeit incredibly 
opaquely written piece of legislation. The principles 
behind it are admirable and do provide a framework 
for doing what we are doing here, which is trading 
off sometimes the invasion of privacy that is 
releasing any information against the benefits. That 
is the main point we were making. We had numerous 
examples of important research that was simply not 
able to go ahead. We had great problems studying 
cancer rates in Gulf War veterans, for example, 
because of that kind of complication, which took us 
a long, long time to overcome. We are saying that it 
is a question of checks and proportionality. In order 
to study the health of Gulf veterans, that most 
people felt was an important question, we needed to 
know who had gone to the Gulf. We could not get 
consent for that because we did not know who they 
were, so already there was a violation of privacy in 
giving us, many years later, the names of those who 
had been in the Gulf. Most had left the service. 
When we did that research, we only had complaints 
from the relatives of two people who were dead. 
Because of the nature of the data, we had been 
unable to get regular notification of death rates 
because there was not a linkage with death rates. 
That was the only time that research caused 
distress—but there was an invasion of privacy, that 
is true. Similarly, when we then went on to do cancer 
linkage for this cohort, there was an invasion of 
privacy there. We have to know the names of people, 
to know who they were to look at their cancer rates. 
We could not do that with consent because three- 
quarters had left the Armed Forces and there was no 
visible means of tracing them. We do not know 
where they are, they have disappeared. The numbers 
are over 100,000. We did the research and we were 
able to show there was not an association. Most 
people were very satisfied with that: I do not think 
anyone felt their personal space, privacy, ef cetera 
had been invaded. Certainly no one said that. 


Q354 Dr Naysmith: Would you think there was any 
case for saying that researchers tend to argue for 
more access to patient data while patients and some 
clinicians often call for stronger privacy laws? 

Professor Wessely: 1 do not think so. I think 
researchers tend to argue for a system of 
transparency and accountability and that the system 
is sensible and that where it should be a light touch 
it should be a light touch. We would argue that, 
when you are talking about an interventional clinical 
trial, you are dealing with a completely different 
beast from when you are talking about wanting to 
link 100,000 cancer records anonymously. These are 
not the same. We have a system that can be too 
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onerous on the things that need light regulatory 
touch; perhaps not onerous enough on some of the 
things that need more heavy scrutiny. We took 
evidence from large numbers of patient groups of 
disease charities who were often baffled by some of 
the bureaucratic hurdles that already exist to doing 
research. As Carol has said, many of the people 
concerned in the Bristol inquiry were simply unable 
to comprehend why some of the research they 
wanted to happen could not go ahead, so I do not 
think it is quite as simple as all that. 

Dr Walport: | think it is important to look at the 
evidence. The Biobank pilot is quite useful. Biobank 
is the study of half a million people aged between 40 
and 69. That was piloted a few months ago in 
Manchester: 60,000 letters were sent to people out of 
the blue aged between 40 and 69. Out of those 
60,000, there were only 50 who raised concerns and 
30 of those individuals subsequently signed up to the 
Biobank study. That is data from an enormous 
number of people, approached out of the blue, a 
healthy population, where only a tiny, tiny fraction 
expressed concerns. I think it is really important to 
look at the evidence. The other side in terms of the 
public support for medical research is that if you 
look at donations to charity 19% of all public 
donations to charity are in support of medical 
research. 

Professor Dezateux: Could I raise a point here about 
access and checks and balances. One of the issues, I 
think, is clarity about who is the definitive 
gatekeeper and what the gates are. We have three 
people in this bed really: the patients, the health 
professionals and the researchers. We have to make 
this ménage a trois work. It is fine for the researcher 
to be accountable and have their job on the line if 
they breach confidentiality but we have to think 
about it from the perspective of the health 
professionals. I think a lot of health professionals 
feel that they have to make that decision for their 
individual. You could argue that is like medical 
paternalism. In studies I have tried to do, why is it 
the doctor is deciding whether their patient should 
receive an invitation to research? That is often the 
position they are put in. Because there is insufficient 
clarity, leadership and guidance to individual 
clinicians about, if you like, what their cover is, they 
are worried that they will be personally accountable 
for releasing or disclosing some information about a 
patient even though they might believe it is for a 
good collective cause or for good of health service 
development, and I think that could be much clearer 
and simpler. I think it does need some leadership as 
well as, as I have said, communication. 


Q355 Sandra Gidley: | was starting to feel quite 
reassured by all this, until I heard the suggestion that 
perhaps we should link more widely to education 
and social services. You start to think to yourself: 
where on earth will this end? I want to put something 
to you to see if it is a possible scenario. You have 
agreed that patients can easily be identified. In fact, 
I think, Dr Walport, you more or less said it was 
essential that you ought to be able to identify 
patients. 


Dr Walport: It depends entirely on_ the 
circumstances of the research. Every piece of 
research needs to be looked at in its own right and 
the principles should be that the maximum 
confidentiality should be maintained. For very large 
numbers of studies, complete anonymisation is 
possible or pseudonymisation. There are some 
studies, however, for example, if you want to 
understand the link between things in the 
environment, where you have to know where people 
live in relation to their health. Under those 
circumstances, pseudonymisation takes you so far 
but someone who is determined—essentially a 
criminal—would be able to find out who that person 
was. Every piece of research has to be looked at in its 
own right but the principle always is as near to 
anonymisation as possible. 


Q356 Sandra Gidley: The drug industry, the pharma 
industry are very keen that this goes ahead. They can 
put together the health data with the mosaic data 
that is widely available which gives certain 
information, increasingly sophisticated, on the 
nature of people in a household, the income level. Is 
there a scenario where a company could target 
people and pay them? 

Dr Walport: No, | think that is inconceivable. I think 
there need to be trusted guardians of the data to 
prevent that happening but also because the reality 
is that is not what the pharma industry wants this 
information for. It is not about marketing; it is about 
drug efficacy and side effects. 


Q357 Sandra Gidley: No, they would target them to 
take part in trials. 

Dr Walport: That is a different question, which is the 
whole question about participation in clinical trials. 
Again, there needs to be a very significant gatekeeper 
there. I think everyone recognises that is a really 
important role for the general practitioner. I think it 
is very difficult to envisage that there would be a 
proper approach where, as it were, a drug company 
could go directly to a patient and say, “I know you 
have diabetes, therefore would you consent.” The 
model for that—and it is the model that has been for 
many years actually in paper systems—is that if a 
new drug is identified which might have value in high 
blood pressure or diabetes, that has to be tried in 
patients and there is a gatekeeper there who is a 
general practitioner who then acts as the conduit and 
says, “Are you potentially interested in taking part 
in a study of a new drug?” If they are, then it 
becomes possible to approach the patient and find 
out about the trial. There is always a gatekeeper and 
that is the only way it has ever been possible to doa 
clinical trial. All electronic systems can do is 
facilitate the identification. It can facilitate the 
communication process but they do not change an 
iota the way in which patients are approached to 
take part in clinical trials. 

Professor Wessely: Y ou are also bypassing that there 
is an ethics’ approval system as well. You cannot get 
around that. That is illegal. 

Dr Walport: 1 do not think there are any new 
principles here. 
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Q358 Sandra Gidley: You mentioned criminals. We 
hear stories all the time of a laptop being left in a car. 
Dr Walport: And notes left on the desk. 


Q359 Sandra Gidley: But the amount of data is 
potentially rather more than a few notes left on a 
desk. 

Dr Walport: It goes back to governance. I do not 
think anyone anticipates a _ situation where 
Connecting for Health would be available on 
someone’s laptop. It is going to be available through 
carefully regulated systems. I do not think this data 
will be left lying around. 


Q360 Sandra Gidley: Are you telling me that 
researchers do not use laptops? 

Dr Walport: They do, but they are not going to have 
the records, as it were, dumped from the health 
system into their laptop. Ina sense, this, again, is the 
general problem and this applies as much to health 
as it does to research—more so. There need to be 
proper mechanisms to make sure the computers on 
which patient information is available are properly 
guarded. I would submit to you that the issue is 
much more likely to cause practical problems in a 
general practice in a hospital than it is in a 
laboratory. 

Professor Wessely: We are not allowed to have 
personal data on the computer. All the data is on a 
standalone system which has no external access. 


Q361 Sandra Gidley: Could I get Dr Walport’s and 
Professor Wessely’s view on whether they think 
there are advantages in widening health information 
to link with education and social services databases 
in the future. I do have some concerns about 
something that large. 

Dr Walport: \s the answer not that all public policy 
should be based on good evidence? Asking the 
question very generically is not terribly helpful. I 
think you have to look at the research question and 
say: “When we discover something that will be 
important.” Carol has already talked about 
disadvantaged groups, so, if you like, knowing that 
people are socially disadvantaged in the context of 
health research is extremely important, and 
therefore that type of social linkage is important. I 
would emphasise that for every case it needs to be 
looked at by an ethics committee. It does need good 
governance but actually there is great opportunity 
for better public policy by using good evidence. In 
fact, the Council of Science and Technology, of 
which I am a member, produced a report on the use 
of data and emphasised the value that could be 
obtained by linking databases across different 
departments. I think this is important. For example, 
it is important to understand about road traffic 
accidents. Health is intimately linked to our social 
environment. Again, no one is asking for carte 
blanche to do this because it is always specific. It is 
not that there will be some gigantic database which 
will hold life, the universe and everything; it is more 
that, if a research question is identified which 
depends on linking social science data of some kind 
with medical data, then it is looked at, it is assessed 


in its own right, and if it will give valuable 
information that could inform public policy then 
that research should be allowed to go ahead, again 
under the conditions, as far as possible, of a 
maximum move towards confidentiality. 

Professor Wessely: In the last year we have looked at 
whether soldiers coming back from Iraq have more 
road traffic accidents. A simple outcome like that. 
We have looked at how quickly people from the 
Armed Forces get jobs and how successful they are 
in their subsequent careers. We have looked at the 
educational achievements of children’ with 
depression. We would like to look at the educational 
achievements of children whose fathers have served 
in the Armed Forces. It is not a blanket thing: for 
each one we will need ethical approval, Caldicott 
approval, PIAG approval. There will be a whole 
system before someone will finally say that is 
acceptable. We are not simply given the educational 
records of every child in the UK. That is not what we 
are talking about. In the system that we already 
have—and Connecting for Health does not 
introduce any new legal challenges, as it were—we 
already have a framework for this. Is what we are 
suggesting a proportionate interference in privacy? 
Is it in the public interest? Is there a duty of 
confidentiality? Is there likelihood of detriment and 
distress being caused by the research? They are all 
the things that we have to go through and if we 
satisfy all those tests I cannot see why that kind of 
work should not go ahead. Indeed, it does go ahead 
already, but it would be so much better with proper, 
single, appropriate data linkage. It would be so 
much better. 

Dr Walport: The word “arrogance” came up earlier. 
It seems to me you can look at that in two ways. I 
think it is also arrogant in a way to introduce public 
policy without being prepared to look at the 
evidence that underlies that public policy and be 
prepared to evaluate whether that public policy is 
good or not. That requires evidence and research. 
Dr Naysmith: We all agree with that. 

Chairman: Yes, there is consensus on that. 


Q362 Sandra Gidley: As the daughter of a soldier, I 
am not quite sure what public interest is served in 
knowing whether my educational achievement was 
effective because you cannot stop soldiers breeding 
and you cannot stop the children moving schools. 
Professor Wessely: You can look at how long they 
spend on deployment and you could look at what 
kind of experiences they have had on deployment 
and what kind of traumas they have experienced and 
how that is reflected. You could look at whether or 
not children may need extra help if their fathers have 
had psychiatric injury, for example. You can look at 
whether or not the fact that they are spending more 
and more months away from home is having 
educational effects. So there are things you could 
look at which you might have wanted to know. 


Q363 Dr Taylor: You have mentioned the Patient 
Information Advisory Group (PIAG). You, Simon, 
have said it is a bit too strong. 
Professor Wessely: Sometimes. 
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Q364 Dr Taylor: We have had people saying exactly 
the opposite, that it is a soft touch, and we have had 
the Information Commissioner right in the middle 
saying it is just right. What should be done? 
Professor Wessely: PIAG was a bit of an emergency 
measure. It was brought in in 2000 when the GMC 
scored almost an own goal with its advice to doctors 
and threatened to undermine the structure of public 
health and cancer registers and things like that. 
PIAG was a way of getting around that. It is not the 
only check and balance we have; it is just one part of 
a complicated framework. We obtained as many 
legal opinions as there are lawyers really as to exactly 
where it sits in the legislative framework and I think 
there is a pressing need as we move to a newera with 
Connecting for Health and new information 
governance to go back and see exactly what the 
legislative basis of it is because it is rather 
complicated. There was a feeling that sometimes it 
did not give a light touch to some of the examples I 
have used. We already knew the names of every Gulf 
War serviceman, all we wanted were the addresses, 
and we wanted the addresses to get consent in order 
to get people for research. We did not feel that was 
quite the same as some of the other issues with which 
PIAG deal. There is a view that there should be more 
systems of class support. By now, after x number of 
years, it should be clearer as to what is acceptable 
and what is not. You should not need to go in every 
instance; you should really go there for advice when 
you have something new, ambiguous, different, 
whatever. The idea of class support does not seem to 
have happened. There was a view from the research 
community that there was not perhaps sufficient 
representation of the people who do use PIAG, 
being the research community, but overall I should 
say there is no doubt at all that the Academy 
completely agrees that we do not have a right to see 
data willy-nilly. Of course not. There must be 
oversight. It is absolutely right that oversight 
balances these various interests and we are utterly in 
favour of that. We think it could be improved and 
made simpler where necessary, so scrutiny is given to 
the difficult cases. Certainly class approval would be 
one way around that. We thoroughly support the 
concept in the future. Whether PIAG continues or 
not, I am not sure, but that structure is needed, no 
question. We would be shocked if such a system were 
not there. 


Q365 Dr Taylor: You have listed in your evidence 
ethics committees, NHS data controllers, the 
Caldicott Guardians as well as PIAG. Should one of 
our recommendations be that there should be a 
review and a coming together of those sorts of 
mechanisms? 

Professor Wessely: They have arisen ad hoc. Section 
60 was a bit of an emergency measure. The legal 
framework is impossibly complicated. I spent a year 
trying to write this thing. If you have to read the 
Data Protection Act, that way madness lies. It could 
be clarified so people all know what their duties and 
obligations are. Many people do not. They either 


think they are more onerous than they are or less 
onerous, so there is a lot of work that could be done 
there that would be very helpful. 

Dr Walport: | would certainly agree there is the 
opportunity for greater coherence. One of the issues 
when PIAG was set up was the philosophy that 
somehow PIAG might only be needed for a short 
time because we were moving to a world where 
consent would be possible for everything. I think it 
has been recognised that that really is not the case, 
that there are always going to be unforeseen 
questions. I think the idea that somehow it was only 
a temporary measure has been a problem with 
PIAG. There is a proposal to have a National 
Information Governance Board. I think that is a 
good proposal. In that context, it might make sense 
if PIAG or a successor body became a _ sub- 
committee of that because there does need to be a 
national committee providing regulatory authority, 
but then the framework for all this does need to be 
looked at. I think the philosophy that this is 
somehow a temporary problem and that consent is 
the answer to everything is wrong. 

Professor Dezateux: | think we need a system and 
PIAG has worked hard and recently introduced a 
fast-track system. There is an inkling now that there 
is a differentiation between the proportionality for 
consents and checks in different contexts. One of the 
key issues is to distinguish between research that 
requires you to go back to an individual, where you 
are interested in that individual and there will be 
some data around that individual, versus 
information where you are not going back and there 
are checks and constraints that would prevent 
disclosure and where the risk of disclosure is very 
low. At the present, if you want to do the latter type 
of research, unless you have a Section 60 exemption 
under cancer or under health protection HIV, as a 
researcher you have to demonstrate that you have 
made all possible attempts to get individual consent 
before you will have a section 60 exemption 
approved. This loses research, it loses time in 
answering important questions as well, and it does 
not always hang together and make sense in 
common-sense terms. We need a system. It will 
possibly be timely to review PIAG because there is 
this idea that the paradigm is individual consent and 
I think we need to have a statement that that is not 
always the case. There are now thoughts about 
community assent models for some issues that we 
know are going to come up again and again, where 
we do not want to have to revisit the infrastructure 
on a case-by-case basis but we want to say as a 
society: “We support this infrastructure approach, 
in a governanced way, to addressing this class of 
question. We are not going to oblige individual 
researchers each time to jump through these hoops.” 


Q366 Dr Taylor: Community assent could take over 
from individual assent in some circumstances. 

Professor Dezateux: Yes. We _ need public 
engagement in these sorts of bodies and decisions. 
Often, in my experience, the public are more 
permissive and wanting the answers than some 
health professionals or gatekeepers. There is a 


Ev 74 The Electronic Patient Record: Evidence 


a a a a IR 
7 June 2007. Dr Mark Walport, Professor Carol Dezateux and Professor Simon Wessely 


danger that at a certain level within the Health 
Service the system is being managed by very risk- 
averse individuals who are worried about litigation. 
Their primary duty is to be very risk-averse for their 
institution rather than thinking about what the value 
is of answering the question that is being posed by 
the research. 


Q367 Dr Taylor: Public engagement is the next 
matter I want to turn to. The Academy of Medical 
Sciences has several sections on this. One of the 
paragraphs ends: “We also warmly welcome recent 
studies undertaken by the Wellcome Trust and the 
MRC to investigate public perspectives in this area” 
and you say that outcomes of this work will be 
published in April. Have I missed that? 

Dr Walport: We have sent you the Wellcome Trust 
report in advance. It has not been published yet, but 
we have sent you a copy of it. 

Dr Taylor: Should I have seen that? 


Q368 Chairman: I do not think it has been 
circulated. 

Dr Walport: 1 am told you have it. If not, let me 
know and I will make sure you do. 


Q369 Chairman: The last question is to Carol. When 
you talked about the issue of this research, of having 
to get back into the system, as it were, and you said 
that it stops research in a sense, having to use the 
current system. Do you have an example of what 
research it has stopped recently and what was the 
intent of that research? Just one will do. 

Professor Dezateux: | can talk about some research 
in my own department where, in the mid nineties, a 
national cohort of children were notified to look at 
the outcome of congenital heart defects that either 
resulted in a foetal diagnosis or in an operation 
before the first year of life, and this was published in 
The Lancet. This was a national cohort. There is no 
information on how many of those children survived 
to secondary school age based on direct observation, 
so we got a study which was peer reviewed by the 


British Heart Foundation and involved all the 17 
cardiac surgery centres in the UK to follow these 
children up through their records in hospital in order 
to establish how many of them were living and what 
perioperative issues might predict their survival to 
12. We had ethics approval for this with no local 
investigator status but we then had to go and register 
this project with every trust that held the data. It 
took a further 18 months on top of the study to get 
these permissions through and in some trusts we 
were asked to resubmit on different forms to their 
own ethics committee and they sent it out again for 
peer review even though I think we would all agree 
the BHF peer review system is pretty excellent. It 
involved the local clinicians, who were very 
supportive of this, in immense amounts of 
paperwork which they were very challenged to 
handle and do. We traced 98% of these children and 
we have shown that 25% of them died by the age of 
12 and we are currently analysing the reasons. The 
other thing we wanted to do was to say what was the 
quality of life of these children and you cannot get 
that information from records. There was a lot of 
misunderstanding, I think, on behalf of the clinicians 
and the trusts about the permission that they could 
give to write to them. We had to write through all the 
clinicians to do that. It did not stop our research but 
only because I have a very determined and 
passionate research fellow who stuck with this has it 
been a success and I think there are other examples 
where people would say, “You know, this is just too 
hard. I am not going to try and answer this 
question”, and I think this is a real tragedy because 
these are important questions, and very simple 
questions often, that we need to address. 

Professor Wessely: We wanted to study the 
outcomes of people who had been discharged from 
the military for psychiatric reasons, what had 
happened to them, and we were unable to do that— 
straightforward could not do it because of the 
framework. 

Chairman: Could I thank all three of you very much 
indeed for coming along and helping us with our 
inquiry this morning. 


Witnesses: Mr Patrick O’Connell, Managing Director, BT Health, Mr Alan Shackman, Independent IT 
Consultant, and Professor Naomi Fulop, Chair of Health and Health Policy, King’s College London, gave 


evidence. 


Q370 Chairman: Good morning. Could I welcome 
you to the Committee and thank you for taking part 
in the third evidence session in our inquiry into the 
electronic patient record. I wonder if I could ask 
you, for the sake of the record, to introduce 
yourselves and tell us what position you hold. 

Mr Shackman: | am Alan Shackman. I have worked 
as an independent consultant since the early 1990s 
largely supporting NHS organisations on what I will 
loosely call electronic patient record projects, so I 
have spent a lot of time with clinicians and managers 
at the sharp end and have a pretty good idea of what 
goes on at the sharp end in hospitals, PCTs and GPs. 
Through 2004 I was NPfIT programme manager for 
NHS organisations across East Manchester. In the 


last couple of years I have largely been working 
outside the health arena, so I suppose I am now an 
outsider, nevertheless an interested and I think an 
expert one. As an expert observer of the present 
NPfIT scene there seems to me to be a number of 
very obvious things to say, so I have said them. 

Mr O’Connell: My name is Patrick O’Connell. I 
came to BT two years ago as their Managing 
Director for BT Health. 

Professor Fulop: My name is Naomi Fulop and I am 
Professor of Health and Health Policy at King’s 
College London. Colleagues and I have recently 
completed a study looking at the implementation of 
the National Programme for IT at local level, which 
was published two weeks ago in the British 
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Medical Journal. 


Q371 Chairman: I have one general question to all of 
you. How would you characterise the progress to 
date on delivering the new electronic patient record 
systems? 

Professor Fulop: From our study I would say it has 
been deeply problematic from the perspective of 
local trusts for a whole number of reasons which I 
can elucidate. As we know, it is seriously behind 
schedule and that has caused problems at local level 
which I am sure we will go into. There has been a lot 
of enthusiasm in the trusts we looked at. We went 
into four acute trusts for the programme and, while 
there is a great deal of support for the vision of the 
programme, there has been a lot of frustration that 
it has been delayed and there has been some loss of 
goodwill. One of the key issues which others have 
identified is that the national programme did not 
engage local stakeholders, end users, clinicians, 
managers, and administrators who were actually 
going to use the systems in the contracting process 
and so they felt very isolated from that whole process 
and felt that systems had been imposed on them. 


Q372 Chairman: We may want to go into a bit of 
detail around that. 

Mr Shackman: | should say that all my remarks 
relate specifically to the Detailed Care Record, not 
to the Summary Care Record, so I give that 
clarification. The Detailed Care Record is now 
coming up for two and a half years late, as stated in 
your briefing document, and by this time next year it 
is going to be three and a half years late. That is 
certainly true for the 60% of the country covered by 
CSC, the iSoft LSP supplier. I think that isa fact. As 
I read it, Guy Hains of CSC has told the Committee 
that the new system Lorenzo will not start to be 
ready until the middle of 2008. Following on from 
that, since the roll-out cannot be done immediately 
it surely means that for many trusts the delay is going 
to exceed four years just to get the first phase done. 
Mr O’Connell: | think the programme is following a 
profile that is somewhat typical of very large 
national transformation programmes. I have been 
managing these things for about 24 years now on 
both the public and private side and I can find no real 
surprise at the current progress. Typically, they do 
have a slow start but with the right spirit and the 
right expertise on both sides they get around the 
corner and they start to perform, and I think that we 
will be able to perform on the programme and I 
think you will see us picking up speed as we go along. 


Q373 Chairman: Can I ask you, Patrick, how many 
Patient Administration Systems you have provided 
up to date now in hospitals in London? 

Mr O’Connell: Up to date I think we have about 18. 
I think probably your question is aimed at acute, of 
which there is one, but in terms of patient 
administrative systems there are about 18. In terms 
of the RiO system, which serves the mental health 
community and also the PCTs, we have about 18 of 
those deployed to date. I might like to add a 
comment about that in the sense that to some extent 


these have moved to the right, as is on the record and 
obvious to everyone, but it is part of the package of a 
large programme in the sense that some things have 
come from the other direction. For example, not 
everything is delayed in the programme; some things 
are new. If you take the London programme, for 
example, their PACS is something that arrived in the 
programme about a year after it started and it had to 
be accommodated by all parties and performed well 
and on time. 


Q374 Chairman: I realise that. We may want to ask 
questions on that, but which hospital is the PAS 
system in in London? 

Mr O’Connell: Queen Mary’s, Sidcup. 


Q375 Chairman: So that is the only one. What is 
your current timetable for completing the roll-out of 
the new PAS systems to all hospitals in London? 
Mr O’Connell: In a stand-alone capability we should 
finish in 2009 and complete and integrated in 
about 2010. 


Q376 Chairman: It is very much behind schedule. 
What are the reasons from your perspective that it is 
behind schedule in this way? I find it very difficult. I 
was looking at patient administrative systems in my 
local hospital over a decade ago. With the new 
system that we have in here quite clearly it is not 
going to be the scene that I was looking at in South 
Yorkshire that is planned for London, but why is 
there this long delay in putting in a Patient 
Administrative System that is common throughout 
London? 

Mr O’Connell: | think there are a lot of factors that 
put the programme where it is today. I started to 
touch on that earlier in the sense that I think a lot of 
large programmes, when ihey start, have a package 
about this size that you want to do in a certain 
amount of time, though typically what happens 
when it starts is that that gets re-shuffled in a bit in 
the sense that some things are brought forward in 
time, like PBR, payment by results, some things are 
added new into this first part, like PACS, which was 
new, like QMAS, the Quality Management Analysis 
System, was new, which was brought in, and some 
things go out. There are other things that people try 
to do for synergy, for example, the common solution 
that occurred between London and the south. It was 
a well-intentioned idea that should work at the 
macro level but did not work at the practical level 
because it turns out that the differences were more 
than seemed reasonable at the time, so I think a lot 
of factors contribute to how we got to where we are 
today. I think maybe a more important factor is the 
fact that the programme is progressing today and 
that if you look at the non-acutes they are 
performing and the acutes are on track to roll out 
starting this summer. 


Q377 Chairman: But why is there delay? Yes, the 
programme is rolling now but why has it taken so 
long? I think you mentioned synergy. This awful 
word we have is interoperability. Has it been 
developing that so that any new system that goes 
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into a hospital in London will have the potential to 
be able to communicate electronically with the rest 
of the National Health Service family, like the local 
GP surgeries? Why has it taken this long to update, 
for want of a better expression, the PAS system? Is 
there any one thing? 

Mr O’Connell: No, 1 do not think there is just one 
thing that does it. I was trying to explain that I think 
it is a multiple set of factors that does it in the sense 
that there is some re-prioritisation which changes 
schedules. In our particular case in London there 
was an attempt for synergy that was well intentioned 
and which at the macro level was reasonable but did 
not work at the practical level. These things came 
together to move the programme to the right. 


Q378 Chairman: The other one, of course, was the 
problems that you had with your company in 
relation to the fact that you switched your main 
supplier for PAS from IDX to Cerner. Has that been 
one of the causes of the delays? 

Mr O’Connell: | think it is a contributing factor like 
the other factors are contributing factors in the sense 
that from my standpoint I think that the common 
solution delayed the programme, as I mentioned 
earlier, for all the right reasons which were well- 
intentioned, and I think that as General Electric 
came in and bought IDX they took a look at the 
package and took a look at their corporate strategy 
and decided not to go forward in a programme space 
but to go forward in a product space, and we 
therefore had to exit them and put Cerner in, and 
that takes some time to do that. 


Q379 Chairman: Are you confident that the system 
you have now will see the timetable met as far as the 
PAS systems in London hospitals are concerned? 
Mr O’Connell: Yes. 


Q380 Dr Naysmith: Can I just ask a question which 
is almost a philosophical question about computer 
systems? What you say has been true of almost every 
big computer system I have been associated with in 
local government, in universities and now in 
national government. They start off and say this will 
be done in two years or three years, and nearly every 
time through the last 20 years that I have been 
associated with a big project it has taken about 
double the time they say at the start, so why do 
people lay the trap for themselves that says, “We are 
going to finish this in two or three years”, when they 
know there are going to be developments that will 
slow it up? Is it because you have to say that to win 
contracts or what? 

Mr O’Connell: No. 

Dr Naysmith: I think you need to expand on that. 


Q381 Chairman: That was a very thoughtful “no” 
there, Patrick. If you would expand on it we would 
appreciate it. 

Mr O’Connell: | guess I started with the last question 
first. No, it is not required. You have just tried to 
make the point philosophically that suppliers say 
they can do something to win a contract. I would say 
no, and I would say more than that. It takes three 


communities—the user community, the buyer 
community and the supplier community—to make a 
programme work on schedule. Everybody proposes 
on day one something that in_ theory, 
philosophically, says all three are bounded together 
properly so that all three move together uniformly. 
What I find is that all three groups are not uniformly 
bound together and that causes delays. It is not like a 
supplier group trying to finesse their way into a large 
programme. It is the fact that large programmes are 
often not completely understood up front. Even if 
someone said, “I would like to move every single 
physical structure inside the M25 three feet to the 
right”, that is a well understood task but when you 
do that you might find that the landfill does not 
really support that thing at the end of the day when 
you check that 10% of the population have moved. 
“Sorry, I made a mistake; move it six feet to the 
north”. By the time you have done that three times 
even a well known problem—I mean by “well 
known” something you could physically lay out— 
would probably not go on schedule, so something 
that is a transformation programme that improves 
healthcare or the next generation fighter is a lot 
harder. | think it is the coming together of the three 
groups. I think it is the level of understanding on day 
one versus day two years on which more 
philosophically answers the question than just one 
element of it. 


Q382 Sandra Gidley: Professor Fulop, you 
undertook some research into the impact of the 
National Programme for IT in hospitals. Would you 
for the record like to tell us what the effect of the 
delays to the new Patient Administration System is? 
Professor Fulop: The delays are of great concern to 
hospitals because, as I am sure everyone here is 
aware, PAS systems are fundamental to the running 
of hospitals and so they are desperate to have their 
current PAS systems replaced and there are concerns 
about patient safety, so, for example, it might mean 
that if the PAS system was not working properly 
they would not be able to call patients in for their 
operations in a timely manner. One of the trusts we 
looked at had a very basic PAS system and had very 
heavy reliance on paper systems and the medical 
director gave a number of examples of concerns and 
real cases of patient safety issues with that reliance 
on paper systems which would have been helped if 
they had had more sophisticated electronic systems. 


Q383 Sandra Gidley: Presumably they had used 
these paper systems for some time so why is there a 
new concern about patient safety? 

Professor Fulop: Yes, of course they have used paper 
systems for a long time but then they can see the 
possibility of what you can do with electronic 
systems. The medical director in this trust gave an 
example of being called to give evidence at a 
coroner’s court on a patient who had died of cancer 
and a contributory factor was that this patient’s X- 
ray had not been read. The medical director’s view 
was that those instances can be reduced with proper 
electronic systems, so you can have alerts, reminders 
and so on and you can improve patient safety, so it 
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is the frustration of relying on old-fashioned systems 
when they can see the possibility of new ones, but 
there is also the issue of actually running these legacy 
systems, the difficulty of getting parts and so on, and 
concerns that they might crash. 


Q384 Sandra Gidley: So that in effect makes it more 
unsafe than the paper-based system because they 
have reduced reliance on them. Is that what you 
are saying? 

Professor Fulop: Yes, and considering going off 
piste, as it were, and replacing the PAS system 
because they do not want to carry on waiting would 
obviously be a ridiculous and inefficient use of 
resources. 


Q385 Sandra Gidley: Because technology rapidly 
gets to its limits and it has needed replacing for some 
time and the longer we wait— 

Professor Fulop: Some of these systems are ten years 
old, say, and they are out of date. There was a classic 
example from our study where in one trust they had 
to get parts from eBay because it is such an old 
system you cannot get parts any more. 

Mr Shackman: Can I come in here because I agree 
absolutely with that? However, a great many trusts 
have perfectly good PAS systems. They may not be 
100% up to date but they work perfectly well, and I 
think with them the frustration has been, stepping 
back a bit, that replacing their existing PAS with an 
NPfIT PAS of itself will not do a huge amount for 
them. It is replacing functionality with not dissimilar 
functionality. The disappointment and perhaps 
where patient safety comes in is with the delay in 
starting to implement the all-important clinical 
support systems that sit on top of the patient 
administration systems and you cannot think of a 
better example than a system that supports 
electronic prescribing. My understanding is that the 
vast majority of prescribing in the NHS is done by 
junior doctors in hospitals, who by and large are the 
least experienced people, so a system that will help 
them make that safer is really a big deal and people 
have known that this functionality is available. It has 
been available for some years. I did a very quick 
assessment of a pilot some four or five years back 
and the delay in getting the ground patient 
administration systems in, whether it be the Cerner 
system or the iSoft system, is delaying what is really 
important, getting the clinical support functionality 
in and, as I say (as a partial outsider now) and have 
said all along, that is what is really frustrating 
many people. 

Professor Fulop: \f | could add another example to 
the e-prescribing: e-test ordering and browsing, 
whereby tests are ordered electronically and can be 
viewed electronically. In one of the trusts we looked 
at they had implemented that prior to NPfIT and 
had this great system which the staff loved and, for 
example, it had reduced duplication of tests, it meant 
that patients and staff did not have to wait around 
for tests, it speeded everything up. When you see that 
possibility that is why others find it frustrating that 
they have not yet got access to that. 


Q386 Sandra Gidley: Patrick O’Connell, do you 
agree that patient safety has been compromised? 
Mr O’Connell: | am not sure I am qualified to talk 
about patient safety but I can speak about it from a 
delivery standpoint, so if you phrase the question 
from a delivery standpoint I will answer it. 


Q387 Sandra Gidley: I was asking you to comment 
on whether patients have been put at risk by the 
delays that your company have presided over. 

Mr O’Connell: That question presupposes that the 
systems in place today before I put a system in 
place— 


Q388 Sandra 
presupposes? 
Mr O’Connell: We are replacing what exists and 
from my standpoint I do not think I am qualified to 
comment on the safety of patients before or after 
NPfIT. 


Gidley: Sorry—that question 


Q389 Dr Taylor: I am delighted we have got you 
here, Mr Shackman, with a long memory because I 
was involved with the fitting and implementation of 
a PAS system exactly 15 years ago and we had 
ordercoms about 13 years ago. I fail to see where all 
the delays have come from. You have been very 
critical of Millennium Release 0. Is there any 
improvement with Millennium Release 0 on what 
was available ten or 15 years ago on PAS systems? 
Mr Shackman: | must tread carefully because I am 
not an expert on Millennium, but my understanding 
is that Cerner Millennium is a very well proven 
system. It is working in many places all over the 
world providing exactly the sort of support that we 
are looking for here. My understanding is, and I 
look to Patrick here who will correct me if I am 
wrong, that Release 0 of Millennium is basically pre- 
NPfIT software which has been implemented in the 
UK down in East London, and I am sorry but the 
name of the trust escapes me. Release 0, as I 
understand it, had not properly been anglicised. My 
understanding is that Release 1, which I understand 
from stuff in the press this week will be available 
early next year, will be the proper anglicised NPfIT 
version of it, so today’s problems, one would hope, 
will disappear, but I bow to Patrick who will know 
a lot more about it than myself. 


Q390 Dr Taylor: So does Release 0 do anything 
more than the original PAS systems that many 
hospitals have had for quite a long time? 

Mr Shackman: No, and alas it appears to do slightly 
less if we read the reports of those trusts that have 
implemented it. 


Q391 Dr Taylor: So Millennium Release | is now 
becoming available? 

Mr Shackman: | understand from the press that it 
will become available from next year. 


Q392 Dr Taylor: What are we getting in London 
from BT? Is that Millennium Release 0? 
Mr O’Connell: To begin with you are getting three 
RO releases, then R1, then R2, then R3. 
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Mr Shackman: \ think Dr Taylor may be referring to 
RiO here as well for the PCTs and for the mental 
health trusts. 


Q393 Dr Taylor: So we will get the updated ones? 
Mr O’Connell: Yes. 


Q394 Dr Taylor: So they will be able to do more 
functionality than the ones we have had for along 
time? 

Mr O'Connell: Yes. 


Q395 Dr Taylor: A general question to all of you. Do 
you think the whole Connecting for Health has paid 
too little attention to hospital systems and has gone 
down the primary care route rather than the hospital 
systems route? 

Mr Shackman: No, | do not think that at all. 
Connecting for Health, it seems to me, has done very 
little for GP systems. As I see it, GPs are continuing 
to use the systems that they had used before, a lot of 
them in quite a sophisticated way. Certainly when I 
go to my GP my practice very much operates an 
electronic patient record within the practice, and I 
think many others do as well. The problem has been, 
I think, that this sort of day-to-day clinical support 
functionality that GPs have has not been available 
for community services, has not been available for 
mental health services and has not been available, or 
has certainly not been implemented, for hospital 
services. The pressing need is to make things happen 
in hospitals. 


Q396 Dr Taylor: And it is right that the majority of 
GP systems that work at the moment are not being 
ripped out and started again? They are just being 
built on? 

Mr Shackman: That is my understanding. I seem to 
have reached an age in life when I can never 
remember the names by which things are called but 
there is a programme for replacing GP systems, if 
they want them to be replaced, with an NPfIT 
version, but so far as I am aware virtually no GPs 
have seen any change to their systems since NPfIT 
came along. 


Q397 Dr Taylor: And, Mr O’Connell, you would 
agree that there has been enough emphasis on 
hospital systems? 

Mr O’Connell: Yes. 1 think from a Connecting for 
Health standpoint, viewing it from the outside, they 
are trying to improve healthcare globally in 
England. It is a global strategy that is being rolled 
out in increments that gradually ends up with 
improved healthcare at the end. There are various 
strategies in different regions. In our region we are 
rolling out the healthcare in a strategy that we think 
puts the most amount of capability on the ground as 
soon as we possibly can with some attention to the 
needs of various trusts, for example, the acute PAS 
that goes to Barnet and Chase Farm this summer. It 
might not improve the capability in a different trust 
but it will improve theirs, so it is somewhat targeted 
in how it is rolled out as well as a general roll-out to 
get a package effect at the end. 


Q398 Dr Taylor: Do you want to add anything, 
Professor Fulop? 

Professor Fulop: | have to agree with Alan that the 
focus has been much more on hospitals than on 
primary care, but I think the disappointment from 
the people that we interviewed has been about the 
loss of this vision of a single integrated system across 
acute and primary care. 


Q399 Dr Taylor: When you say “loss”, has that been 
lost completely? 

Professor Fulop: As 1 understand it there has been a 
rolling back of that idea. 


Q400 Dr Taylor: Where does that come from? 

Mr O’Connell: Can I answer that because I would be 
the one who was rolling it out or back, either way. 
From our standpoint, there has been a change in 
London, for example, in the fact that instead of one- 
size-fits-all we have moved to a new philosophy 
called best of breed where we have Cerner for acute, 
we have the CSC RiO for mental health and 
community health and we have in-practice at the 
moment as an alternative for GPs, but even though 
it is a best of breed approach we have three different 
vendors, and there are many reasons for that, but it 
still provides a single view in the sense that a single 
view can be provided in a couple of ways. It can be 
provided with the same box or it can be provided 
with different boxes that integrate into a single view. 
From my perspective in one way we are providing 
the original vision of a single view. We are 
implementing it somewhat differently in a way that 
we think brings more benefit to the users and more 
benefit to the community as a whole over a variety 
of factors from capability to cost. 


Q401 Dr Taylor: We went to Homerton Hospital 
yesterday and we got the distinct impression from 
them that they were absolutely delighted that they 
had got in first before NPfIT came so they could 
design their system and get it exactly as they wanted 
it. Is the effect of NPfIT that it has really taken away 
the end user input and just delayed things? 
Professor Fulop: | think that is problematic. I have 
to say that I think there is a trade-off between having 
a national system and local customisation and that 
balance has to be thought through very carefully, so 
the more local customisation you have the more you 
lose the national vision. Under the previous policy, 
hospitals went their own way and some had PAS 
systems that were quite far advanced, as you 
mentioned, and others did not, so I think there is 
something to be said for having a national policy and 
national standards, but it is allowing that degree of 
local customisation where people feel ownership and 
can adapt the systems to their local needs. I am sure 
that is technically challenging, but I think it is 
important. 


Q402 Dr Taylor: That should be one of our 
recommendations if it is not too late? 
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Professor Fulop: Yes, definitely. 

Mr Shackman: | do not see why it is too late. As we 
have heard, there is a continuing delay before the 
systems will be ready to be put in. There is plenty of 
time for some changes to be made. I am particularly 
interested by the change of philosophy that Patrick 
was talking about, a move more to a best-of-breed 
approach, which I observe is not being followed 
elsewhere in the country but certainly is in London. 
One of the questions that I have asked—I put it in 
my written submission but by no means am I saying 
that this is the right way to go; it merely seemed to 
me an obvious question to ask even if the answer was 
going to be no—is, is it possible to give trusts a 
choice of core system that they take because, as 
Naomi says, if they have had a hand in choosing, if 
there is an element of customisation perhaps, based 
on choice, there is much more chance that they are 
going to adopt it, implement it properly and get 
the benefits. 


Q403 Dr Taylor: They have got a decision about 
choice? 

Mr Shackman: That is right, and it seems to me that 
possibly what is now happening in London, to take 
it one step more, is that if you can have different 
suppliers to GP systems for community, PCTs and 
mental health and a third different supplier for 
hospital systems and, as Patrick says, you can bring 
those together to produce a common view, which is 
what BT most certainly will do, then you can 
probably accommodate choice as well. Let me 
rephrase that. I asked the question: if it is possible to 
do that could you also accommodate choice to allow 
trusts to say, “Mmm, I think we would rather have 
X than Y”. 

Dr Naysmith: If I could break in there, yesterday 
when we were at Homerton I discussed this 
particularly with the chap whose name I have 
forgotten who was a consultant for two days a week 
at the hospital. 

Dr Taylor: Eccles. 

Dr Naysmith: He said there was an element of choice 
that was available for local trusts setting this up but 
they had to— 

Dr Taylor: Is that just in London or— 


Q404 Dr Naysmith: Just in London, but they had to 
ask for it and it was a bit discouraging. I wonder 
whether that is true or not, Mr O’Connell. You will 
probably know, but he was giving the impression 
that people were not anxious to encourage new 
trusts to explore the options that were open to them. 
You had to have somebody on site who knew that 
that was possible and was confident enough to do it. 
Otherwise you were given the job lot. Is there any 
truth in that? 

Mr O’Connell: | cannot speak for all the places but 
I can tell you that what we are doing now is that we 
engage the trust far in advance of delivering the 
system. The reason we engage them far in advance, 
and we also engage them with Connecting for Health 
so it is a kind of tripartite system, is to try to ensure 
that the principles of standardisation and some of 
the necessary customisations are understood well in 


advance so that we can meet the needs of a particular 
trust. It is hard to have a one-size-fits-all for the 
various different trusts or hospitals in any country, 
let alone in the city of London, so we engage with 
them early. Secondly, we have structured our 
London programme such that we have the ability to 
configure the code, which is a kind of base code, and 
then there is a configuration machine that turns 
things on and turns them off because it is quite a 
large product that is used in many countries and we 
select pieces that we want and we modify some 
others, but we have the ability to do that in London 
and so we can and in fact have changed the 
configuration in London so that it is different from 
the south to reflect the individual needs of the trust 
or the community as a whole. We do not really say 
Release 0 of Cerner in London. We say LC 0 or just 
London configuration 0 and that reflects the 
customised needs, so to speak, of the London trust 
or the London community. It also reflects some of 
the solutions that we have incorporated, given the 
experience at Homerton or given the experience at 
another trust. We have the time to incorporate those 
and we do, so I think it is actually the opposite. We 
actively engage the trust to find out what they want. 
I think that they are part of the solution with 
Connecting for Health. For example, even though 
RiO is not the point in question here, it is really 
acutes, you have not really heard much about the 
RiOs going in and it is quite a large undertaking to 
put those in, and they have got on well because we 
are doing the same thing. We collectively engage 
with the trust, try to make sure that we can fit their 
complex environment, their needs, and then we roll 
it in, and we are doing the same thing for the acutes. 
We just have a bit more flexibility with the acutes. 


Q405 Chairman: If the Homerton system is 
compatible as far as your system is concerned, 
presumably if you are doing all the PAS systems in 
London hospitals you will be looking at Homerton 
and saying whether it is up to muster, will you? 

Mr O’Connell: Actually, the London system in a 
foundational sense reflects the Homerton base line, 
SO, as it is a system that people are happy with and 
feel is a very good baseline to start from, because we 
have the ability to customise in the London 
community we are using that as our baseline and 
then improving it or modifying things or adding to 
it as we go along for the various trusts. What Barnet 
and Chase Farm needs is a little bit different than 
Homerton but the foundation is a better foundation 
to start from and we are doing that. 


Q406 Chairman: But the customising in Homerton 
presumably would not be interfered with when they 
are rolled out with the rest of London? What they 
have now in terms of their fields, on their database, 
the way that they are using their system to run 
Homerton Hospital and the improvements that it is 
giving them and giving patients, will that change 
when your system is rolled out? 

Mr O’Connell: No, that will not change. 
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Q407 Chairman: It will not change at all? 
Mr O’Connell: No. It will actually be improved. 


Q408 Chairman: When you talk about configuration 
London you are not saying that every PAS system in 
every hospital in London has to be the same in every 
detail, the records on it or anything else? 

Mr O’Connell: Correct. 


Q409 Chairman: That by and large will be a cohort 
of things in there that will be common, and 
obviously that will be the case in a record anywhere 
in the world, but after that there will be local 
autonomy into the detail of what is on that record 
and obviously how it is used within that particular 
establishment? 

Mr O’Connell: Yes. 


Q410 Dr Taylor: So this flexible, best-of-breed 
approach is obviously the right one. I do not know 
if it is fair to ask, but are you aware if Fujitsu or CSC 
have got the same flexibility? 

Mr O’Connell: It is totally outside my remit to 
comment on that. 

Dr Taylor: Yes, I know it is outside your remit. I am 
ashamed to say I cannot say immediately whether it 
is in their evidence but it is something we need to 
find out. 


Q411 Chairman: One of the issues that we have 
heard, not about the acute sector, was about the 
choice of a general practice system and that you were 
potentially offered one or two software packages 
and you must go along with that. Now we 
understand it is not double figures but it is more than 
one or two, so the choice in terms of what that 
establishment wants to make is being made but 
within a system that is sensible because it will be able 
to talk to the wider health community at some stage. 
Your system is giving a base for that and then 
London hospitals will add on to that base, or is it 
offering two or three different suppliers of the 
software? 

Mr O’Connell: Fundamentally what we are trying to 
do is maintain the original vision of a single view so 
that a patient’s record can be viewed in a variety of 
care pathways. 


Q412 Chairman: Would that be just on one software 
system or would it be potentially on several? 

Mr O'Connell: No, it would be on more. The system 
is an interoperable system because best of breed does 
a couple of things in the sense that if you have Cerner 
for one, you have in-practice with the other and you 
have CSE for the mental health and community, and 
an interoperable approach allows you to interface 
different systems in the sense that if Cerner is the 
right answer today, like in rental cars if you have 
Avis and Hertz and Avis says, “We try harder”, if a 
number two “try harder” system comes in place we 
can fit that in without losing the original vision of a 
single view. Secondly, if you have an interoperable 
solution it allows you more easily to interface with 
legacy systems because you already have an 
interoperable system. Thirdly, it allows you to make 


slightly more customised modifications in the 
domain that you are speaking of, like acute, without 
having to change anything in the GP domain. 
Finally, it gives you a little bit more of a cost effective 
solution going forward because you do not have a 
sole source lock on a single event. You have pieces 
that can be removed and so not only does it push 
capability forward; it keeps the price at a more 
reasonable package. It is a standardised system but 
it has some flexibility where it needs to have 
flexibility to address the various needs because 
hardly anything is 100% identical. 

Mr Shackman: My understanding is that within that 
flexibility all London acute trusts will have the 
Cerner system, all London PCTs and mental health 
trusts will have the RiO system and all GPs will have 
the in-practice system or the alternate. It is a 
mixture, is it not? There is an element of 
customisation. The fundamental system is set. I am 
not saying that is wrong. I am just saying it for 
clarification. 


Q413 Dr Naysmith: What is the understanding of the 
panel members of the requirements for the Detailed 
Care Record? What do you believe it should be 
doing? 

Mr Shackman: | have read some of the other 
evidence and in so far as I have had time I have read 
through oral evidence. The key thing is that if I had 
been a complete layman it would not have come 
across to me. The Summary Care Record is basically 
an information repository. It is a database that you 
can look into and I know there is argy-bargy about 
what goes into it and what does not but it is a 
database, but a Detailed Care Record is much more 
than that. The Detailed Care Record is the electronic 
patient record system that the LSPs are going to 
deliver. The key thing is that the Detailed Care 
Record more than a database allows clinicians and 
others to do things. It allows them to prescribe 
drugs, to order tests. It allows care plans to be 
devolved. It allows quite complicated things to be 
done, so, if a patient is coming in for a hip operation 
with the right system, at the press of a button you 
can schedule all the things that need to be done 
around that—book the theatre slot, book the 
physiotherapist, book the occupational therapist, 
even put an appointment in the district nurse’s diary 
so that when the patient is discharged they can be 
there on day one to provide support. Without 
getting into the detail of what data is in the Detailed 
Care Record, I would concentrate on it being an 
everyday tool that allows clinicians and managers to 
do things to speed up and make the health delivery 
process safer. It is what I have meant by an electronic 
patient record for the 15 years or so that I have been 
involved in the field. 


Q414 Dr Naysmith: I think you have described that 
very well and brought out what it means. It means 
that this system has to be able to cope with all sorts 
of different specialities because patients do not 
always see just one kind of doctor; they go off for X- 
rays and radiology and all sorts of other things 
which, as you suggested, might have to link up with 
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what used to be called almoners in social services 
and all sorts of things could be in the Detailed Care 
Record. Is the system capable of doing that? Is it 
versatile enough? 

Mr Shackman: My understanding is that the Cerner 
Millennium system is capable of doing that. I do not 
know what the Lorenzo system is capable of. It is not 
available. 


Q415 Dr Naysmith: But it does mean that data has 
to be presented in a uniform way from all these 
different sources that it comes from. Just as one 
example, last year Richard was at the same meeting 
as I was, where in Choose and Book one of the 
problems that hospitals had was that different GPs 
described different medical procedures in different 
terms and different hospitals had different ways of 
describing the procedures they carried out, and 
Choose and Book was not the same. We were going 
to order this from that hospital and then you could 
find problems with what was being defined, and that 
is happening now. 

Mr Shackman: That is surely so. You do have to 
have people describe things in the same way. I am 
getting towards the extreme of my knowledge here, 
not being a medical person, but my understanding is 
that that is comparatively straightforward to get 
sorted out within a single organisation, within a 
hospital or within a PCT. It is much more difficult, I 
imagine, to get it sorted between GPs and hospitals 
but perhaps I can just add a small comment about 
the famous “walk before we run” comment. It has to 
be absolutely right that the NPfIT vision is looking 
at doing things consistently across the whole local 
health community. We have to bear in mind as well 
that almost all hospitals do not even have some of 
their internal clinical support systems compatible, 
never mind doing things across the local healthcare 
community, which we must do. Again, as a bit of an 
outside observer, a little air of unreality sometimes 
descends on me, not because things I hear are wrong 
but because it is perhaps trying to do too much too 
quickly before you have even sorted out some of the 
fundamentals. 


Q416 Dr Naysmith: Professor Fulop looked at four 
different trusts. Can you give us some indication of 
what the situation was like there? 

Professor Fulop: What 1 would add about the 
detailed record is that it has not been communicated 
to people what it is. In fact, I checked on the 
Connecting for Health website and what is described 
there is much more limited than what Alan has just 
described and is quite vague, and that is what we got 
from our interviews, that it was not clear to people 
exactly what it was and I think Connecting for 
Health missed an opportunity there. 


Q417 Dr Naysmith: Do you think in the four trusts 
you were looking at they were collecting and using 
different data and different sorts of data or was it all 
standardised and useful? 

Professor Fulop: Yes, | would say at the time that we 
went in there, because there had been very little 
NPfIT implementation, they were all at different 


levels, so one had a PACS system, for example, the 
other three did not or it was very limited. They were 
quite a good spread. One that I talked about earlier 
had a heavy reliance on a paper system and very little 
electronic functionality, so they were not even 
standardised in terms of the level that they were at 
in terms of IT organisation, let alone what they were 
collecting. 


Q418 Dr Naysmith: Mr O’Connell, Mr Shackman 
has described the very detailed and useful working 
data set. Professor Fulop says that people do not 
really know what it is meant to contain, so what do 
you say? 

Mr O’Connell: There are various contexts that we 
are speaking to. I guess, for context, to make sure we 
are speaking of the same thing, there is a Detailed 
Care Record and there is a summary record. The 
Detailed Care Record is basically your medical life 
history moved from paper into electronic, so that 
you can back it up so you do not lose the papers, so 
that you can take advantage of the benefits of the 
systems of electronic connectivity in the sense of 
being able to order electronically radiology, a 
laboratory test or whatever the case may be. I know 
this is captured in the RiO system, it is captured in 
the in-practice system, so from our standpoint it is 
reasonably well understood. Certainly from a 
technical standpoint the pathways to integrate this 
data are going to exist and our end plan will be there. 


Q419 Dr Naysmith: But they are not there yet; is that 
what you are saying? 

Mr O’Connell: Correct, they are not there yet. They 
are more in a stand-alone area right now to get the 
capability on the ground. Once the capability is on 
the ground so people have systems in place then we 
will integrate these systems so that they can take 
advantage of the electronics so that one could have 
the power of having the Detailed Care Record 
electronically captured in a single place, backed up 
so that you do not lose it and so that you can take 
advantage of the benefits. 


Q420 Dr Naysmith: So what will the Detailed Care 
Record look like in, say, ten years’ time compared 
with now? 

Mr O’Connell: | guess, as I said, it will be an 
electronic version of what you have today. 


Q421 Dr Naysmith: What, a big pile of sheets? Are 
you talking about the paper record? 

Mr O’Connell: No. 1 think the record is driving 
towards being electronically captured, stored, 
manipulated and managed, and all the various 
papers that you see today in various trusts or various 
facilities from the time you are young to the time you 
are older will gradually disappear and move into a 
kind of paperless system where you look at people’s 
records on a screen and if you want to do something 
you will be able electronically to request something 
and receive something. 


Q422 Dr Naysmith: Where do you think it will be in 
ten years’ time, Mr Shackman? 
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Mr Shackman: | would go along with that. As to 
whether it is ever going to be possible to capture 
everything electronically, I think people do feel they 
have some sort of God-given right to record some 
things with a pen. I think the key thing is, as I said 
before, that the systems support clinicians in the 
day-to-day things that they do. It is the ordering, it 
is getting the test results, it is the prescribing, it is 
recording that the drugs have been given. It is the 
Choose and Book, which is just an example of 
functionality. It is smoothing the process between 
when a patient is discharged to when they get home. 
Let me give an example, if I may, from my own local 
hospital: after an out-patient appointment the 
doctors dictate into a Dictaphone, that goes to a 
secretary, that gets typed up, a month or so later the 
letter gets sent to the GP practice, when it gets to the 
GP practice the first thing that happens is that it gets 
scanned electronically onto the system. The systems 
that we are talking about really ought to make it 
possible for that whole process to be done there and 
then without this almost ludicrous manual 
intervention, but to do that, difficult though it is 
proving to get the systems in, the real issue, if I may 
say so, is the change management, changing the 
process, which goes beyond the remit of Connecting 
for Health and I understood was going to be covered 
by the work of a Modernisation Agency which no 
longer is with us, so I struggle a bit to find any 
concerted way of helping make the process change 
happen whereas of course there is a most concerted 
way of actually getting the technology in. 

Professor Fulop: Can | support that point from our 
research. Patrick mentioned that we had an 
understanding from a technical point of view and I 
think that is the root of the problem, is that there has 
been a focus on technical issues and not enough 
focus on what we might call the socio-cultural issues 
and change management issues in implementing 
these systems from a clinical point of view and from 
a managerial point of view, and I think that 
absolutely has to change and we have got 20 or 30 
years’ evidence from the research literature on other 
implementation of IT innovations about that need 
and it is rather surprising that that failure has 
happened again. 


Q423 Dr Naysmith: That was very obvious to us at 
Homerton yesterday that the clinicians needed to 
lead the project if it was going to get the hospital staff 
involved properly. My very final question is to Mr 
O’Connell really. This standardisation between 
hospitals and between Primary Care Trusts and 
between different kinds of settings in the NHS is very 
important for research purposes and _ for 
communication. Was there any involvement of the 
Royal Colleges in standardising and defining terms 
and descriptions? Did that happen, do you know? 
Mr O’Connell: | am sorry, I do not know that, I do 
not have the answer to that question. 


Q424 Dr Naysmith: I do not know whether you came 
across that, Professor Fulop? What involvement was 
there of different disciplines in designing 
standardisation? 


Professor Fulop: What I can say from our research is 
that at a local level, clinicians and managers did not 
feel involved in those discussions. 


Q425 Chairman: When you talk about a Detailed 
Care Record and a Summary Care Record, which 
we will move on to hopefully in a few minutes’ time, 
what is your general understanding, that I as a 
patient will have two records, one detailed, one 
summary, in ten years’ time? Is that what it will be? 
Mr O’Connell: My understanding of the two records 
is that the Detailed Care Record, as I said earlier, is 
a complete electronic capture of your basic record. 
The summary record to me is a bit of a safety net for 
unplanned events that would occur, so for 
example— 


Q426 Chairman: Right, so there would be the two 
records. Is that your understanding as well? 

Mr Shackman: Yes, very much. The key thing is the 
detailed record and all the functionality that goes 
with it. 


Q427 Chairman: Y ou think there will be two as well? 
Mr Shackman: But you extract what doctors decide 
is necessary to support emergency care if you are 
away from home. I was interested reading Dr 
Braunold’s oral evidence, I think I am right in saying 
that she said that in a few years’ time she thinks that 
the summary record will become much less 
important because the key information will be in the 
detailed record or there will be less need for the 
summary record. It is a sort of stand-in because we 
do not have the detailed record yet, so to my mind 
the summary record is very much what falls out of 
the detailed record rather than being something 
completely different. 


Q428 Chairman: Why I ask the question is that of 
course Detailed Care Records are held presumably 
electronically both in my GP’s surgery and at my 
local hospital because I was an in-patient for a while 
many, many years ago and there are going to be two 
Detailed Care Records, are there not? 

Mr O’Connell: No. 


Q429 Chairman: There will only be one, so your 
understanding is that everything that comes from a 
past system in London will be passed down to the 
GP or vice versa? 

Mr O’Connell: The intent of the Detailed Care 
Record is to be a single repository of your medical 
history or your health care record in a single place in 
addition to the other benefits that we have talked 
about. 


Q430 Chairman: Is that everybody’s understanding? 
Naomi, is that what you understand also? Hopefully 
you do not, but if you went into the acute sector all 
the information that would be held there would be 
then passed down to your Detailed Care Record 
presumably? 

Professor Fulop: My understanding is that the vision 
was that it would not be passed down, it would be 
available so that hospital staff and primary care 
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staff, wherever they were, would log in and they 
could look at my detailed record. That is what my 
understanding of the vision was. 


Q431 Chairman: So it could be held on two different 
databases but just made available? 

Professor Fulop: This is going beyond my 
understanding of the technical issues. My 
understanding is that there was one database to 
which a number of different people in different 
places had access, tell me if I am wrong, that is what 
I thought the vision was. 


Q432 Chairman: We will discuss the summary one 
later but I want to know about the Detailed Care 
Record. I think we know potentially what it is but 
where is it, is it on more than one database; it must 
be, must it not? 

Mr O’Connell: The Detailed Care Record is 
intended to be a single repository and intended to be 
typically in a single place. However, in the realm of 
computer science sometimes it may be convenient to 
have something in a different location depending on 
usage of a particular aspect of it. So I think the 
physical location of a database with the physical 
location of items in computer science is probably less 
relevant than the concept of a single Detailed Care 
Record for a person. 


Q433 Chairman: I have spoken to a number of 
people, not in formal evidence sessions, and they say 
quite clearly, “I am a GP and there are some things 
that are on your Detailed Care Record in the local 
hospital which I do not need to know, probably the 
discharge is all I need to know electronically,” you 
are discharged from there so my GP would not 
necessarily want to keep the Detailed Care Record in 
my local district general hospital, or indeed in a 
London hospital if I was ever taken into there. 
Personally speaking—and I am not speaking for the 
Committee on this—I am confused about what the 
Detailed Care Record is, is it one or is it more than 
one? I understand that the detail that may be on it 
would be far more detailed than on a Summary Care 
Record—and we will get to Summary Care Records 
and I think we know what the plan is with the 
Summary Care Record—but I would like to know 
what the plan is with the Detailed Care Record. Is 
acute and primary going to come together on one 
plan? 

Mr Shackman: Can | most unhelpfully say that I 
think I am about as confused as you are. 


Q434 Chairman: Thank you, that is reassuring, 
Alan! 

Mr Shackman: Certainly it seems to me that if the 
GPs are going to continue with their own GP system, 
then information that they have put in will be on 
their system and the information that comes from 
the hospitals or elsewhere may be on a database 
elsewhere but, as Naomi said and I think you have 
as well Mr Barron, not everyone needs to know 
everything. Your GP is not in the least bit interested 
in the detailed day-to-day nursing care plan but is 
very interested in the discharge summary, so this 


may also be unhelpful, to my mind it is not 
something that matters terribly, but that is just to 
my mind. 

Chairman: Are we going to have two records, or 
three records I ought to say in these circumstances, 
or possibly four or five, if I travel around the country 
a lot and I have got a complaint that takes me to the 
acute sector now and again so I am logged into 
somebody else’s computer in a hospital system? 
How is it going to work? 


Q435 Sandra Gidley: If there is a mental health trust 
that is a separate record yet again or is not? 

Mr O'Connell: It is separate data in the sense that 
data from mental health is different to data from 
acute health, but the point is to have a single, 
Detailed Care Record that may be stored on more 
than one database for computer science reasons, and 
people who have the proper access and proper 
authority may be able to download parts that they 
want, so a GP is likely to keep things in a GP’s 
surgery that he wants to keep right there, so if you 
want to say that is a separate record you could say 
that but in an LSP there is a single record that is used 
by a variety of people in a variety of circumstances 
but it is the basic record. The GP may download 
something, mental health may keep a piece of it if 
they want, but it is the same ultimate record tied to 
the same parent record. 


Q436 Chairman: It is not physically in one place? 
Mr O'Connell: Correct. 


Q437 Chairman: It is called a record but it is an 
amalgam of where I have interacted with the health 
care system in a detailed way? 

Mr O’Connell: Correct. 


Q438 Chairman: I think I have got that now. Have 
you got it, Alan? 

Mr Shackman: | might have, yes. 

Professor Fulop: \ think we have to find a way of 
communicating it in such a way that healthcare 
professionals and the public understand at a very 
basic level what it is. 


Q439 Charlotte Atkins: I think that discussion has 
probably demonstrated that the Detailed Care 
Record however we define it will require a lot of local 
IT systems being linked together to share 
information, but how long are we going to have to 
wait for this given that most hospitals have not yet 
received even a basic system? We were at Homerton 
yesterday and although they have their own system 
they were not able to communicate that 
electronically to the GP because the GP, as the 
Chairman was saying, might only be interested in the 
final discharge summary or notes, and maybe that is 
not a big issue, but given that they were really 
moving quite impressively to an electronic almost 
paperless system within the hospital, if that is going 
to work effectively for all hospitals there are going to 
have to be linkages with GPs as well and when do 
you think that is likely to happen given that we are 
now proceeding so slowly through this route? 
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Mr O’Connell: In 2009 we hope to have the stand- 
alone capabilities integrated so that the sharing of 
the record in authorised, appropriate ways has 
occurred, so this year and next year we are rolling 
out the basic stand-alone capability for the 
community as a whole to have that established and 
once it is established that we have the capability then 
we intend to link it together. 


Q440 Charlotte Atkins: So that is the stand-alone 
but will that then be fully questionable by the mental 
health trust, as Sandra mentioned, or the GP, will it 
be an all-singing all-dancing system? 

Mr O’Connell: 1 am not quite sure about the all- 
singing all-dancing, but it is intended to completely 
link up the system so that you have the data that you 
need when you need it on the system, which is the 
point of it, so we will do that. 


Q441 Charlotte Atkins: It will not just be the 
summary, it will actually be the detailed record that 
we can access? 

Mr O’Connell: The detailed record. 


Q442 Charlotte Atkins: Can I ask Mr Shackman and 
Naomi as well, you both expressed concerns that the 
new systems provided by the national programme 
will not link together in the way that was originally 
planned, do you think that this will undermine this 
whole process we are discussing of bringing together 
the Detailed Care Record? 

Mr Shackman: 1 have some difficulty, thinking 
about 60% of the country that is covered by the CSC 
LSP, because I cannot profess to understand what 
the Lorenzo system is going to look like. I 
understand that it is still being developed. It was 
supposed to be available from 2004 but has not been. 
I am merely stating what is in the public domain. We 
understand from CSC that it will start to be 
delivered by this time next year. I have been reading 
this week, and no doubt you have as well, the 
shenanigans (is as good a word as any) going on 
between iSoft and CSC and potential buyers and 
this, that and the other, and I do not know what is 
going on, but it surely cannot increase our 
confidence that the development is going to be 
successful. So certainly I have not heard of any firm 
dates for implementing clinical functionality 
effectively north of London but there again I am not 
part of the programme, I have no access to the 
detailed information systems, so there are doubts 
there. So far as the South is concerned, where Fujitsu 
is operating, presumably they can be in precisely the 
same position as BT in London, presuming that they 
can get either from Cerner or elsewhere the 
functionality necessary for PCTs and mental health 
trusts. My understanding—and Patrick will correct 
me—is that the Cerner product at present does not 
have specialised functionality to support community 
services and to support mental health applications. 
You will correct me if I am mistaken. 

Mr O'Connell: \t does have it but we are not using it. 
We are using Cerner for the acute space only. 


Q443 Charlotte Atkins: Professor Fulop, I think 
your research was indicating some problems or some 
concerns about hospital trusts and the national 
programme being able to operate together? 
Professor Fulop: Yes, and what I would say is that 
there is a lot of enthusiasm in hospitals for them to 
be able to link up and to link up with primary care 
and so on in their community. I understand there is 
less enthusiasm from GPs and also frustration that 
there has been a focus on functions, particularly 
Choose and Book, which locally they did not 
particularly see as a priority and saw as driven by 
other concerns than those to improve clinical care. 


Q444 Charlotte Atkins: Mr O’Connell, do you think 
that people are right to be concerned about this lack 
of integration or do you think that this is something 
which will just progress and will work in the future? 
Mr O’Connell: The integration does not exist today 
and people are operating. I think the integration will 
improve what is there already and I think as we move 
forward and we integrate these entire systems it will 
bring better healthcare to the fore. 


Q445 Charlotte Atkins: So you think that 
integration has not be been sacrificed in terms of 
trying to just progress on the individual new 
systems? 

Mr O’Connell: It is a lot of things, just like building 
a house, there is a certain order of precedence in 
order to establish things in terms of foundation and 
gradually working your way up and so what we are 
doing in London, for example, right now would be a 
proper profile to deliver the capability that we have 
signed up to do in the correct order to do that. 


Q446 Charlotte Atkins: I suppose time will tell. 
Mr O’Connell: Certainly. 


Q447 Charlotte Atkins: We shall have to see how 
that actually works, but certainly a lot of people 
have expressed concerns that the Detailed Care 
Record is going to be a real struggle to deliver in 
terms of its electronic system. Do you share that or 
do you think that people are just scaremongering 
about that concern? 

Mr O’Connell: | think there are two aspects to that. 
There is probably an operational aspect to it, which 
I am not really qualified to speak to, but from a 
technical aspect to it the capability will be there to 
share the records. I think it is like a lot of things, it 
may be in the 80/20 category in the sense that 
probably most of what people want will be there, but 
there is bound to be something not there that they 
want and, again, I think that is something that can 
be overcome so I think the system will probably— 
and it is a little bit outside my realm here—move 
forward to much better capability and will continue 
to improve as we go along. I am not quite sure if the 
Internet is a good analogy here because I have not 
thought it out before I showed up, but to some extent 
in 1990 if I was to look at the Internet I was not sure 
whether the Internet would be a good business tool 
or not, in 1995 I kind of changed my mind, and 
today it would be very hard to live without it. I think 
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the concept of putting English medicine on-line is a 
little bit like that because it is quite a complex task 
to do even though some things can be described 
somewhat simply, and I think that what you are 
seeing is that we are gradually improving our IT 
capabilities to enhance healthcare and it will kind of 
move in a profile like that—and I am not trying to 
make an analogy about timelines or anything, I am 
just saying that something as significant as this and 
so transformational as this will gradually improve so 
technically we are on our way and I think we are 
progressing very well in the sense of if you look at the 
record of what we have done, and I think that 
operationally it will probably enhance itself as it 
moves along. 


Q448 Charlotte Atkins: Given the obvious potential 
patient benefits of the Detailed Care Record being 
accessible electronically, what can be done to speed 
up this whole process, because it does seem to be 
taking a very long time and I think patients and 
clinicians are likely to get frustrated over the time 
that it is likely to take? 

Mr O'Connell: \t is something that we have of course 
been thinking about as we think about progressing 
the issue and as how to go forward faster. We are 
looking at a few items right now with Connecting for 
Health and with the users about how to do that. 
There are a few tasks in particular, for example like 
the task of cleansing the data and migrating the data, 
which is quite an onerous task and a larger and more 
complex task than most people might have imagined 
on day one. 


Q449 Charlotte Atkins: I think plenty of people 
imagined what a detailed task it was, that was one of 
the issues. 

Mr O’Connell: | take that back. I was not here on 
day one so that was speculation on my part. It is 
quite a significant task and today much of that task 
is done with the local trust and a small amount of 
that task is done with the supplier. One of the things 
that we think we could do to go forward faster is to 
change the ratio and change the roles and 
responsibilities of who does what to insert it in the 
new system. If you take a look at the various IT 
departments that we have dealt with already, there is 
a variety of resource and a variety of expertise 
available, and one of the things that we could do 
potentially is take an industrial strength approach to 
the IT and the data cleansing and data migration 
and that might move it forward faster. In London 
for example there are 74 trusts. For each trust each 
time we install a new system it is the first time for that 
trust. For us it depends on where we are. If we are at 
the 37th trust it is our 37th time so what we try to do 
is take advantage of the lessons learnt so you have 
one group which does it 74 times and not 74 groups 
which do it one time, and some of the things that are 
part of those lessons learnt would be the data 
collection and data migration, so we are currently 
discussing that with Connecting for Health now in a 
very favourable and positive way, and with the 
trusts, to potentially alter the roles and 


responsibilities a little bit so that IT and data 
cleansing and data migration goes with the group 
which does it for a living versus the trust group. 


Q450 Charlotte Atkins: I think what we learnt from 
Homerton Hospital was the fact that it had to be 
very much the clinicians in control in terms of 
developing the system rather than the IT specialists 
telling clinicians how they could actually use the 
system. 

Mr O’Connell: That is true but I think there are 
elements to that in the sense that a supplier like BT 
could not and would not make any clinical decisions 
but in extracting the data from the place that it is at, 
getting a consolidated single place and then turning 
it over to clinicians, could be faster than the way we 
are doing it right now. In other words, everybody in 
their proper roles and responsibilities and to some 
extent IT with IT, but it is a lot of steps involved in 
order to get it to the point where a clinical person can 
say, “I would like it this way,” or, “I would like the 
process to be like that.” We might be able to move 
that faster than local IT staff or clinical people doing 
it part time with some clinical and some IT. 


Q451 Charlotte Atkins: Would Professor Fulop like 
to comment? 

Professor Fulop: Your point about clinicians being 
involved is absolutely key and I would add that the 
local trust needs support to implement it, it does not 
just happen, so they need resources to support 
project management, training, and so on, and also 
this issue that Alan mentioned earlier about changes 
in working practices. If we are really going to get the 
gains from this IT modernisation that everybody 
wants, it also means addressing how professionals 
work and manage to work differently and to my 
mind that is not happening yet and we really need to 
focus on those issues as well. 

Mr Shackman: To my mind one of the reasons why 
you got some good vibes from the visit to Homerton 
is knowing a little bit about the background, the 
clinicians there were involved in the decision to go 
with Cerner in the first place. I know that there is a 
very enthusiastic core group of clinicians there who 
really wanted to make these changes happen. They 
may have been a bit frustrated through technical 
problems and such like but it is really good to hear 
that you were there yesterday and they seem to have 
climbed out of that. That is the key thing, changes at 
the coalface level have to be driven by some local 
people, so you have got to get them switched on to 
do it. Give them good systems—and that is Patrick’s 
business—then find ways and give them the space to 
learn how to use them properly and make the 
changes. 


Q452 Sandra Gidley: We heard earlier, and I think 
we are clear now, that even within the Detailed Care 
Record you have got a lot of different systems that 
have to talk to each other and there are the different 
elements of the health system. Has Connecting for 
Health done enough to set clear standards to ensure 
that that will happen? Patrick, you may be able to 
talk more as you have got more direct experience. 
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Mr O’Connell: From a technical stand-point and a 
delivery stand-point we have and I think we are all 
well-engaged at this particular point. As I mentioned 
earlier, they are well integrated into the customer 
engagement process and so the question about 
clinicals earlier, from a clinical stand-point, from a 
management stand-point, from an IT stand-point, 
from a migration of data stand-point, I think they 
are well-engaged in the sense of delivery. 


Q453 Sandra Gidley: So from a technical point of 
view the speculation is clearly written, it does not 
keep changing and it has been clear from beginning 
to end where you are going on this? 

Mr O’Connell: | am not saying it has not changed. 
The specification has changed from day one to day 
now. What I was speaking more of in the now sense 
of where we are to today is I think that Connecting 
for Health is fully engaged with the user community 
and the supplier community to roll out the capability 
on the ground, whether it be the mental health or 
the acute. 


Q454 Sandra Gidley: That is not the question I am 
asking. I am asking whether the work done by 
Connecting for Health, the standards they have set, 
are clear enough to enable everybody to get on with 
it and deliver what is needed? Are the standards 
there which will enable the different parts of the 
system ultimately to join up with each other and talk 
to each other, because if they are not we might as 
well give up and go home now. 

Mr O’Connell: | think that they are there today and 
the evidence of that is that we are rolling out 
capability on the ground in London for example. 


Q455 Sandra Gidley: But you are not yet rolling out 
anything that can talk to anything else? 

Mr O’Connell: No, but it is part of a sequence of 
events versus a lack of standards. 


Q456 Sandra Gidley: Sorry, versus a what? 
Mr O'Connell: A \ack of standards. 


Q457 Sandra Gidley: Can you explain that? Iam not 
quite sure what you mean by that. Can you elaborate 
on that point? 

Mr O’Connell: | was trying to answer your question 
in the sense that when you say we are not there now 
in terms of everything talking to everything that has 
to do with the fact that when you take the sequence 
of events of rolling things out, at a certain point 
they will. 


Q458 Sandra Gidley: And you are confident? 
Mr O'Connell: | am confident they will. 


Q459 Sandra Gidley: What mechanisms are in place 
to make sure that the individual suppliers stick to 
what is happening? 

Mr O’Connell: There are a lot of mechanisms in 
place but from a commercial stand-point in terms of 
the contract in place and from a practical stand- 
point, in our case in London for example, in order to 
make sure that they can all talk together there are 


two ways to do it, a relatively complicated integrated 
engine or a relatively simplified communication 
traffic cop, and each of our vendors, the three basic 
vendors have already modified their message 
formats— 


Q460 Sandra Gidley: Sorry, modified their what? 
Mr O’Connell: Their message formats. They have 
made their computer science stuff adapt to a 
common standard that we have to make sure that we 
can communicate, so it is already done. 


Q461 Sandra Gidley: That was not Connecting for 
Health, that was pragmatism because it was not 
working, so you are saying Connecting for Health 
did not set those clear standards to start with? 

Mr O’Connell: No, it had to do with the changing IT 
in the sense that on day one we had IDX which was 
a single vendor. Today we have three vendors and a 
best of breed and in creating three vendors, which 
was my decision to pursue that which was eventually 
accepted by Connecting for Health, one would have 
to do what I just did to make them talk together 
because I felt it was a better strategy, so we created 
a standard for these things to come together. 


Q462 Sandra Gidley: Excuse me for labouring this 
point but if Connecting for Health had set very, very 
clear standards to start with you would not have had 
to do that, would you, it would have worked 
anyway? 

Mr O'Connell: | think we may be speaking at 
different levels and at cross-purposes. I think the 
standards for single view are clearly set. 


Q463 Sandra Gidley: I am talking now about how 
everything will work together. 

Mr O'Connell: | think the standards for how things 
will work together are there and are clear. What I 
was speaking to (because I thought you were asking 
that) was a little bit how do I know when safeguards 
are in place and I moved into the implementation 
space and the fact that physically things have been 
changed to make sure that it comes together. So I 
think it may have been a “levels of discussion” issue 
more than it is not there. Sorry for the confusion. 
Chairman: There was an issue that was put to us by 
one of our earlier witnesses that standards had not 
been agreed across the piece before the whole 
national programme was set up but there are other 
people we have asked that question, although we will 
have some more at some stage in this inquiry as well, 
so we do not have to labour it particularly now. 
Sandra Gidley: I was just trying to— 

Chairman: That is fine. 


Q464 Dr Naysmith: A fairly quick question for Mr 
O’Connell. The N3 network provides fixed 
broadband connections across the National Health 
Service now. Will hospitals not also need wireless 
connectivity in order to take full advantage of 
detailed records systems? 

Mr O’Connell: 1 think they can all probably take 
advantage of it with the current fixed system but we 
are currently in the process of trying to voice enable 
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the N3 system so that people can use it with either a 
fixed service or a mobile service and technically we 
are about there today and by the end of the year we 
should have that rolled out. 


Q465 Dr Naysmith: Are there plans to provide this 
then? 
Mr O’Connell: Yes. 


Q466 Dr Naysmith: And they are fairly well worked 
out and they are going to just follow in sequence 
when the time comes? 

Mr O’Connell: Yes, it was a matter of extracting 
more value out of the basic investment in capability 
that exists in terms of fixed service and now we are 
trying to move on to do greater things with it such as 
Voice Over IP which gives people the ability to use 
it with voice and wireless. 


Q467 Dr Naysmith: Presumably that will involve lots 
more money as well? Was it a different contract? 
Mr O’Connell: No, it is a levered circumstance 
versus a “from scratch” circumstance. 


Q468 Dr Naysmith: Fine. A question to Professor 
Fulop. Your research shows that hospitals feel they 
are—and I quote from your evidence—at the 
“bottom of the food chain” because decisions were 
taken about the national programme and _ local 
service providers without their involvement. We 
have talked about that a little bit already but how do 
you think this could be addressed if we want to try 
and make sure that it does not happen in the future? 
Professor Fulop: \t means that Connecting for 
Health and the suppliers need to engage much more 
with local end users, as I have said, and I am pleased 
to hear that apparently in London that is happening 
more now because without it these systems will not 
work. 


Q469 Dr Naysmith: You say the new NPfIT Local 
Ownership Programme will help to address the 
problem? 

Professor Fulop: 1 hope so, although that was 
actually announced after we finished our fieldwork 
so I cannot say how that has gone down in the trusts. 


Q470 Dr Naysmith: It has been suggested that it 
might just be a token gesture or a recognition of the 
problem without doing all that much about it. Is it a 
bit too soon to say that? 

Professor Fulop: | think it is too soon to say. I would 
just say I very much hope that it is more than a 
token gesture. 


Q471 Dr Naysmith: Do you know anything about 
this, Mr O’Connell? 

Mr O'Connell: The NHS _ Local Ownership 
Programme, yes I do. From our perspective it is 
something that will help deployments of the 
capability to London. 

Dr Naysmith: I suppose we could explore that 
further. 

Chairman: Okay, the Summary Care Record. 


Q472 Dr Taylor: The Summary Care Record—to 
me this should be the simplest thing in the world and 
yet we went to a demonstration of it at Richmond 
House just a couple nights ago and it was impossibly 
complicated. Somebody seems to have got the whole 
system confused between the Summary Care Record 
and the Detailed Care Record. My first question to 
Naomi is as far as you know has there been end user 
involvement in deciding what should go on the 
Summary Care Record? 

Professor Fulop: What J} can say is that from the 
perspective of the staff in the trust that we looked at, 
no, but I could not say there has been none from 
others. That is the most that I can say. 


Q473 Dr Taylor: That gives an impression. We are 
told that the roll-out has now commenced. They do 
not call them pilot sites now, they are early adopters, 
which is a nice euphemism that does not tie you into 
anything. We are told that that roll-out has 
commenced but nobody seems to be able to tell us 
what the exact content of the Summary Care Record 
is going to be so how has the roll-out commenced? 
Do you have a clear idea of what should be on the 
Summary Care Record that you are actually about 
to implement? 

Mr O’Connell: | guess the question to me is more 
along the lines of can I build what I am supposed to 
build in the Summary Care Record— 


Q474 Dr Taylor: Unless you know what it is on it? 
Mr O’Connell: Yes, we have a specification for what 
it is right now. We are putting that together and 
technically it works today. 


Q475 Dr Taylor: Right, so what is the specification 
that you have been given for the Summary Care 
Record? 

Mr O’Connell: { would have to get back to you on 
the specification itself in terms of data fields, you 
mean the data fields and the content of it? 


Q476 Dr Taylor: Why is it not a single screen with 
demographic data, alerts, allergies, medical 
problems and current treatment? Why does it have 
to be any more than that, all of you or any of you? 
Mr O’Connell: To be clear on the last question, you 
are asking what should it be, which is really a 
healthcare answer. I was saying that technically if 
healthcare has an answer we will build it. 

Dr Taylor: Yes, that is very clear, you are not the 
person to tell me what should be on it. 


Q477 Sandra Gidley: You said you had a spec 
regarding the data fields. 
Mr O'Connell: Yes. 


Q478 Sandra Gidley: I got the impression the other 
night that in the early adopter sites people were 
saying, “We would like this included, we would like 
something else included”—I do not particularly 
want to go in details—so are you having to adapt as 
you go? 
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Mr O’Connell: That is the point, yes, of the early 
adopter. Your early adopter is trying to work out the 
issues from ethical to practical of what really should 
constitute this summary record, so what are the 
essential or key elements needed to have somebody 
from the South who has a car accident in the North, 
you pull up this summary record to see what allergies 
he has, like allergies to penicillin for example, just 
exactly what should that look that and how that 
should be arranged, that part is the purpose of the 
early adopter programme to work out the details of 
the various communities of interest, come to an 
agreement and work their way through it. Some of 
them are theoretical, some are ethical, philosophical 
and practical and we are working our way through 
it right now so, yes, we have a spec, I expect it to 
change over time, at some point I expect it to steady 
up and then we roll it out. 


Q479 Sandra Gidley: That is clear, so you are always 
expecting the data fields to change? 
Mr O'Connell: Yes. 


Q480 Dr Taylor: As far as any of you are aware has 
anybody actually defined what they mean by a 
Summary Care Record? To me a Summary Care 
Record is something short, possibly one computer 
screen. Has anybody defined this? 

Professor Fulop: On the Connecting for Health 
website it says exactly what you said: “will contain 
any basic information such as current medications, 
adverse reactions and allergies. After that, each time 
someone uses any NHS health services, details about 
any current health problems would be added.” 


Q481 Dr Taylor: In the evidence that we have got 
from the Department of Health it expands on that 
tremendously and the demonstration we had again 
was more of a Detailed Care Record, as I would have 
seen it, so you have been told what fields you have 
got to have? 

Mr O’Connell: At this point in time I would like to 
add I heard the earlier testimony before and just like 
“Secondary User Services” it gives a label that might 
not as best it could capture the value of the data in 
there. The word “summary”, as you said, might 
sound like a very short thing but that may not be the 
best label because it is intended to be for an out-of- 
hours emergency circumstance so that you can get 
safe care if somebody does not have access to your 
detailed record, and so maybe that is why it takes a 
little bit longer to sort it. 


Q482 Dr Taylor: What I am getting at is who has 
defined what “summary” means in _ these 
circumstances and who has decided what should go 
on it because that seems to me to be absolutely 
crucial? Would it be breaching commercial 
confidentiality to allow us to see the specifications 
that you have had for the Summary Care Record? 
Mr O’Connell: | think that is something you would 
probably have to work with Connecting for Health 
on. 


Q483 Dr Taylor: But it would be possible to let us 
see it? 

Mr O’Connell: From a Connecting for Health stand- 
point if it is reasonable from their perspective it 
would be reasonable from ours. 

Dr Taylor: Thank you. 


Q484 Chairman: It may be the case Richard, as I 
understand it, that what you are looking at is the 
actual technical standards. 

Mr O’Connell: Correct. 

Chairman: That is the issue about what fields are in 
it in terms of what information would go on my 
Summary Care Record, which is_ probably 
something that we did see earlier this week in 
Richmond House and we can ask the question to see 
if there is any difference to that, Richard, if there is 
a conflict in evidence that we have received written 
or otherwise. 

Dr Taylor: I am just trying to get at the exact content 
because the system we saw at Richmond House 
would have put off any doctor in an A&E 
department from even beginning to look at it 
because all you want in an A&E department is the 
basics. 

Chairman: We will have a look at that. 


Q485 Dr Taylor: Right, sealed envelopes; how far 
are you on the way with sealed envelopes? 

Mr O’Connell: We are progressing on schedule and 
they should be ready next April/May. 


Q486 Dr Taylor: So April 2008? 
Mr O’Connell: Correct, April/May. 


Q487 Sandra Gidley: You have not got the spec yet 
so how can you be on schedule? 

Mr O’Connell: We have a spec for it as it stands 
today. 


Q488 Sandra Gidley: We had heard in previous 
sessions that there was not yet a proper specification 
for the sealed envelope technology. 

Mr O’Connell: It might be that the story is not over 
on what should go into a sealed envelope and what 
should not, and that is a different story. 

Dr Taylor: Ah, what should go into it? 

Sandra Gidley: No, I understood it was the 
technical spec. 


Q489 Chairman: I have to say if it is stated that the 
sealed envelope is ready that is in conflict to what we 
have heard earlier in these evidence sessions. Our 
understanding is that the encryption, which is 
presumably the technical word, was not yet ready for 
really sensitive information on records being put 
into a sealed envelope. 

Mr O'Connell: The patient sealed envelope 
specification exists and we are building to that. The 
clinical sealed envelope is not yet done, as I 
understand it. 


Q490 Chairman: Could you tell us the difference 
between the clinical and the patient one, I do not 
understand that? 
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Mr O’Connell: | can speak to the patient in the sense 
that the patient sealed envelope is what the patient 
deems he wants to have not well-shared by 
everybody. 


Q491 Chairman: Yes, it would be on a Summary 
Care Record but it would be encrypted it would be 
in a sealed envelope that may or may not be opened 
by anybody looking at the whole of the Summary 
Care Record? 

Mr O’Connell: The contents of the patient sealed 
envelope is determined by the patient. 


Q492 Chairman: I see, so what is the clinical? 

Mr O’Connell: | am not sure but I believe the clinical 
is what the clinical person feels is appropriate or 
inappropriate or safe or unsafe to put in there. 


Q493 Sandra Gidley: And how long have you had 
the spec, some time? 

Mr O’Connell: It has been some time. I do not 
remember but it has been some time. 


Q494 Dr Naysmith: Are you saying this is 
information that need not be shared with the 
patient? Are you saying that the clinical sealed 
envelope is something that the clinicians want to 
have on the record but need not be shared with the 
patient? If it is, it is the first time that I have heard 
of it. 

Mr O’Connell: {| would say that I am familiar with 
the patient sealed envelope but I am not familiar 
with the clinical sealed envelope. 


Q495 Chairman: We might be in conflict, we might 
be talking about evidence we took on the Detailed 
Care Record earlier, but if that is not clear can we get 
back to you in writing about that? 

Mr O'Connell: Certainly. 

Chairman: | think it is important in terms of the 
Summary Care Record which is going to be the 
national record that is going to be sat on somebody’s 
database. I think we are on to Sandra. 


Q496 Sandra Gidley: Earlier we were talking about 
the Secondary Uses Service and we had quite a lot of 
evidence as to how it was probably useful to be able 
to extract names and addresses and refer back when 


it comes to pseudonymisation. Other people have 
raised significant concerns that the data is not 
anonymous enough. I believe it is currently 
pseudonymised by replacing the information that 
includes name, address and postcode, but other 
NHS systems use postcodes as identifiers in various 
work such as public health work on deprivation. Is 
there any way that postcodes could be removed and 
the system will still work? Patrick O’Connell, I 
believe your company is responsible for the 
anonymisation of data? 

Mr O'Connell: We do both. We do the 
anonymisation of data, which is stripping out any 
kind of personal data, and the pseudonymisation of 
it, where you scramble the data, and mix other things 
in it so that even if you could read it you still would 
not know what it said, it would be hard to put it 
together. Postcodes from a technical stand-point can 
work however the community feels is the right way 
to make it work. So if postcodes are important to 
have I think we could fit those in. If postcodes should 
not be in there because you were concerned about 
inference attacks, then we will not put them in there. 


Q497 Sandra Gidley: So this is a decision that you 
are working to rather than having any say over? 
Mr O'Connell: Yes. 


Q498 Sandra Gidley: Okay, that is fine. What have 
you actually done to test your pseudonymisation 
systems to make sure that patients cannot be 
identified? How do you test how robust that is? 

Mr O’Connell: There is a lot of procedure to try to 
make sure that data is safe in an old-fashioned 
physical sense to a software sense to a hardware 
sense to a procedural sense, to continually try to 
penetrate the software yourself to see whether or not 
you can find holes in your own system. Every bit of 
time that goes along systems and counter-systems 
have a tendency to seesaw all the way up and so we 
are continually checking on a regular basis to make 
sure that we feel that it is safe. 

Sandra Gidley: I think that is it really. 

Chairman: Can | thank all three of you very much 
indeed for coming along and assisting us with this 
inquiry. Thank you very much indeed and we hope 
we will have the report out some time this year, I 
think my phrase should be at this stage. 
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Q499 Chairman: Good morning. Can I welcome you 
to what is our fourth evidence session on our inquiry 
into the Electronic Patient Record? I wonder, for the 
sake of the record, if I could ask you to introduce 
yourselves and to tell us what position you hold? 
Could I start with you, Mr Burns? 

Mr Burns: My name is Frank Burns. I am a recently 
retired chief executive of a large general hospital on 
the Wirral where I was chief executive for 17 years. 
During the course of my employment at the Wirral I 
was seconded for 18 months to draft an Information 
Strategy for the National Health Service which was 
published in 1998 under the title of Information for 


Health, and which has been subsequently 
superseded in terms of the implementation model by 
the National Programme for Information 
Technology. 


Dr Markham: My name is Dr Gill Markham. I am 
a consultant radiologist now in North West Thames, 
I was previously in Liverpool for about 25 years, and 
I am Vice President of the College, who I am 
representing today. 

Professor Feehally: 1 am John Feehally, I am a 
kidney doctor. I work as a consultant in Leicester. I 
have just completed a three-year term as President of 
the Renal Association, which is our professional 
society of kidney specialists in the UK, and I also 
chair a group called the Renal Information 
Exchange Group, which is a professional and 
patient group which has got itself together to try and 
ensure that the renal health community influences as 
much as it can and in the best possible way it can the 
whole information and knowledge agenda within 
the NHS. 


Q500 Chairman: Welcome once again. Could I start 
by asking a couple of general questions? The aim of 
introducing electronic patient records is to improve 
the quality of patient care. To what extent do you 
think this has been achieved to date? 

Mr Burns: By no means as much as it has the 
potential to improve the quality of patient care, but 
the fundamental requirement for electronic records, 
in fact “electronic records” sometimes misdescribes 
this technology, because the best of this technology 
is patient care management systems, not simply 
electronic means of recording what has happened to 
patients, the best of these systems actually support 
practising clinicians in their day-to-day work 
providing better care for patients; and where clinical 
management systems have been installed, and they 


have been implemented in various parts of the 
country, not as widely as we need them and not with 
the urgency with which we need them, there is very 
serious evidence of the capacity of these systems to 
improve patient care, but they have to be deployed 
at the operational level, they have to be functional at 
the operational level, they have to be tools which are 
used on a day-to-day basis by clinicians—doctors, 
nurses, community nurses, specialist nurses—right 
across the spectrum of care. There are very graphic 
examples of how information technology deployed 
in a Clinical setting cannot just improve the quality 
of care but can dramatically improve the safety 
environment in which patients are cared for. 

Dr Markham: My particular remit is the imaging 
aspect of it, but I also use the Electronic Patient 
Record in my trust. To give you an example, if] want 
to have a pathology report, that is immediately 
available. So, the patient benefit is indirect but it is 
safer availability, it is instant availability and 
accurate availability because you can go straight 
into the record and get it, but, as I say, it is within the 
trust that I have experience of that and, obviously, 
the imaging side of it, which we will go into later, I 
am sure. 

Professor Feehally: There is absolutely no doubt 
about its potential. It is beginning to come in in some 
places, but in quite a lot of those places it has come 
in or is coming in, it is quite independent of 
Connecting for Health, it is initiatives taken locally 
by others either before Connecting for Health or, 
indeed, since it began but in spite of. We often think 
about it within an institution like a hospital, but for 
me the real gain is across primary, secondary, 
tertiary care within a network. To give you a single 
example, I was in my clinic yesterday afternoon. I 
saw a man in his sixties with diabetes who has kidney 
disease. He has a complex problem. I see him often. 
Three days before he was in the diabetes clinic. One 
week before that he was with his GP. I could not 
access blood tests from any of those. He is an 
articulate man who told me what had happened to 
him, but if he was not I would not have got that 
right, and that is transformed overnight if you get 
these things in, but we are not seeing it yet. 


Q501 Chairman: Survey evidence has shown that 
doctors’ confidence in the national programme has 
fallen sharply since 2003. Why do you think this has 
happened and what can be done about it? 
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Mr Burns: | think it touches on the points we have 
all three just made, that what clinicians want is 
functioning technology that will support the work 
that they do on a day-to-day basis. I think a lot of 
clinicians are frustrated, for instance, about the 
focus of Connecting for Health on the Summary 
Care Record. The Committee has heard enough 
evidence already about the delays with this 
programme. I do not think we need to repeat the fact 
that there is huge frustration about the fact that, 
despite the fact that Connecting for Health has been 
in existence since 2002, if you go round the NHS into 
the operational clinical services there is very little 
evidence as yet of the clinical systems that we are 
describing. There is lots of activity around the 
implementation and replacement of Patient 
Administration Systems, but these are not the same 
thing. Patient Administration Systems have existed 
in the NHS for many years. They are administrative 
systems, they support the processing of patients, 
they do not support the care of patients, and it is the 
elements of the technology that supports the care of 
patients which is slowest in coming forward. In 
many parts of the country, people have begun to 
despair of it as to whether it will ever arrive and I 
think a lot of clinicians are very frustrated about the 
focus on the national Summary Care Record, about 
the creation of a national approach to sharing 
information and the lack of priority that is currently 
being given to the development of the 
implementation of clinical systems at the clinical 
level and the sharing of information, in the way that 
my colleague describes, so that doctors and nurses, 
when they are treating patients, have a good, up-to- 
date, reliable, accurate picture of everything that is 
happening to that patient. Most patients come to 
harm in the NHS in the course of day-to-day care; 
they do not come to harm necessarily, to a greater 
extent, because their records are not available if they 
happen to turn up at some distant hospital, 
unconscious with no identification. I think the 
evidence for the benefit of the Summary Care 
Record has not been presented, and I think that 
evidence could easily be obtained. It is not a difficult 
thing to scope, in terms of the current NHS, how 
many patients are going to benefit in terms of remote 
need for emergency care. The real priority for the 
NHS, for the NPfIT, for Connecting for Health, in 
my view, and I think it is a view that is supported by 
most clinicians, is for Detailed Care Records at a 
local level, and I think it is the absence of progress 
with that that is creating the frustration you allude 
to. 


Q502 Dr Naysmith: Do you think there has been too 
much emphasis on this emergency care? 
Mr Burns: | do, yes. 


Q503 Dr Naysmith: Do you think that is one of the 
real problems, concentrating on this record being 
available? 

Mr Burns: It is not the only thing that NPfIT are 
pursuing. NPfIT can list some very creditable 
achievements, not least in PACS, which is picture 
archiving technology for radiologists. I am not here 


to condemn everything that Connecting for Health 
is doing, but I do think that the focus on the 
Summary Care Record is a misplaced priority. | 
think it is of less value clinically and less value to 
patients than the deployment of clinically rich 
functional technology supporting doctors and 
nurses on a day-to-day basis, and there is no sign of 
that being delivered to the NHS any time soon. 


Q504 Chairman: Do you have anything to add to 
that? 

Dr Markham: Just to say that Professor Feehally 
alluded to the fact that much of this had been present 
before, and we will no doubt come back to PACS in 
a moment, but an awful lot of PACS was available 
prior to this and in many ways it has muddied the 
waters, although it has rolled it out much quicker 
than it might otherwise have been, but it was in place 
in many places way before NPfIT. 

Professor Feehally: To add to what Frank said, it is 
lack of progress which frustrates clinicians, but there 
has also been an appalling communication failure 
from the beginning. The early attitude was, “We are 
the computer experts. We will let you know when we 
need a little something from you, because we will roll 
this out and it will work”, and they have gradually 
retreated from that as they have realised it is actually 
difficult, but what they have not done is really 
listened to clinicians and they have assumed that 
when we say, “This is difficult”, or “This is 
complex”, or, “This is quite sophisticated”, we are a 
bit old fashioned or a bit Luddite or do not 
understand, rather than assuming we really did 
understand something very complicated we worked 
within for a long time, and we have used computers 
for 20 years in some ways, so it is a communication 
failure. 


Q505 Chairman: Frank, would it be fair to say that 
out of the Detailed Care Record comes a Summary 
Care Record? 

Mr Burns: Yes. 


Q506 Chairman: This is putting the cart before the 
horse. Would you go as far as to say that? 

Mr Burns: Yes, | would. It is true about clinical IT 
that all of the secondary purposes flow best from 
focusing on the principal purpose. The principal 
purpose is to support the care of patients, and if you 
give total priority to the principal purposes, which is 
supporting the care for patients, all of your 
secondary purposes will flow naturally from that. If, 
for instance, you had good, effective, supported 
clinical systems in hospitals—you already have them 
in general practice, it is in hospitals that there is a 
great black hole in terms of good functioning clinical 
systems—if you deal with that and focus then on 
technologies that can integrate the information in 
those records at a local level so GPs and hospital 
specialists who work in a partnership on a day-to- 
day basis can have a shared view and, as my 
colleague said, even specialists working in the same 
hospital can have a shared view of what is happening 
to a patient, I am not a technologist, | am not an IT 
specialist, but I am very confident that if you had 
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good, local Detailed Care Records, the technologists 
would not have too many problems in extracting the 
information that is needed for a national Summary 
Care Record, if there was a case for a national 
Summary Care Record. But bearing in mind that 
most people attend their local hospital if they have 
an emergency, the occasions when any of us fall over 
in a distant town and need emergency care are not all 
that frequent compared with mothers rushing to the 
local hospital ‘with their sick child because they are 
not sure why they are crying. Most of this care is 
delivered locally, not remotely, and that is why the 
focus should be on delivering this functionality 
locally. 


Q507 Chairman: I do not understand all the 
technical side of this, but in a sense for that to 
happen, for my GP to share records that are in my 
local district general hospital, they have to be 
compatible, and that is something we have not been 
very good at. The Patient Administrative System a 
decade ago was sharing no discharge notes at all 
with my local GP service, and I expect that was the 
case for the whole of the borough. It seems to me 
there has probably been an emphasis on making sure 
that, whatever systems are eventually installed, they 
are compatible systems so that you can deliver that. 
Has that been one of the major issues, do you think? 
Dr Markham: To a degree, but prior to NPfIT there 
were systems that were set up locally—for instance 
access to specialist services. If you had a patient 
coming in with a head injury at night, then you could 
beam your images off to the local neuro-surgical 
centre for an opinion, and in some ways that has 
been made more difficult for NPfIT coming in. I 
suspect, although, again, I am not obviously a 
computer expert, these difficulties could have been 
got round in perhaps a slightly less all-encompassing 
way. The idea is very good, but I would entirely 
support what Frank Burns has said that the vast 
majority of healthcare is done in your local 
community. In the case of London or any of the 
conurbations, or even down in the South West, 
patients go to their local hospital, they may go toa 
specialist service in a hospital three miles down the 
road and that is the sort of sharing that we need 
rather than one end of the country to the other. 
Professor Feehally: To repeat the answer in a 
different way, if at the beginning of this sorry process 
they had simply given local health networks some 
resource and said, “You will just simply resolve the 
question of the primary care computer system 
talking to the hospital computer system”, we would 
all now be smiling, because there have been many 
other things we had not yet got, but that alone would 
have advanced the healthcare system, and that is 
what we wanted. 


Q508 Chairman: John, you were talking earlier 
about clinical engagement in all this, and we have 
seen examples of where that has happened certainly 
for the good in my view. How do you actually get 
clinical engagement when you have got (I think the 
national figure is) 700,000 clinicians working inside 
the National Health Service? What happens? Where 


this has happened, how many people are really 
engaged with looking at the system that has been 
introduced and making sure it does fit their needs 
and the patients’ needs in terms of that locality? 
Professor Feehally: You do not need many 
champions. Where one has seen success there have 
been a small number of senior clinical leaders who 
have believed in it and have begun to demonstrate 
change, and then you take the clinical community 
with you. What you do not do, to use my specific 
example, I have on several occasions approached 
Connecting for Health at several levels saying, 
“Here I am; I represent the kidney world. We spend 
2% of the NHS budget on dialysis and transplant. 
Chronic kidney disease is very common and it is a 
cardio-vascular risk marker. We are a big group. 
Can we please talk to you?”, and they have not 
answered the email, not given me an appointment. I 
have simply never spoken to anybody. They have 
not wanted to talk to us. So at that level it is 
frustrating. 

Mr Burns: | think philosophically there are a couple 
of approaches. The approach that preceded NPfIT 
where local health communities were, if you like, 
expected to source, procure, implement systems 
locally, there is a better opportunity for getting a 
critical mass. You do not need every clinician, but 
you need a critical mass of people, the leaders 
amongst the clinicians, as you do with any 
endeavour, and you can get a critical mass of local 
clinicians involved if there is some element of local 
choice of system. The more you scale that up the 
more difficult it is to achieve that, and you have to 
accept, and I accept, that if you accept the argument 
for national procurement, then there is no practical 
way you can achieve local clinical engagement. 
There is no point pretending there is a practical way, 
because there is not, and if the benefit of national 
procurement is greater than the need for local high 
input of clinicians, then you make the argument and 
you go on that basis, and I accept that. But if you do 
go on that basis, then you have to deliver quickly 
what it is that you are procuring nationally. If you 
say to doctors, “There are too many of you to 
involve you in the choices and the economics 
benefits nationally outweigh the argument for local 
choice, so we will do it this way because we will get 
it cheaper, because it is cheaper there will be more of 
it, because it is cheaper we can give you more 
sophisticated software, it will be better, then you 
have to deliver it, you have to come up with that; and 
if they are still waiting after five years, which is what 
the case currently is, then you have lost your way in 
making that particular argument. Then what you 
have got is not an argument about engagement, you 
have got a problem of disengagement because 
clinicians have disengaged because they see no 
evidence of what was promised in place. 

Dr Markham: The way it was done with PACS is a 
very good example. The sudden cluster, as is now, 
was almost ready to roll out. People had been 
agreed, they were going the same way, they were 
going to connect up, and then it stopped on the basis 
of a national procurement. In practical terms what 
happens is you have perhaps a consultant radiologist 
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and a radiographer who have a particular interest in 
it in a trust or in a group of trusts and they are the 
ones that develop with the vendors what is required. 
They say, “This is the problem. This does not work. 
How can you make this work? This is what we want 
to do”, and the work is very good and there is very 
close co-operation over a period of probably ten, 15 
years as it developed, and that is why it was good. 


Q509 Dr Naysmith: Was there any evidence of 
radiologists being reluctant to use the new system 
when it was being introduced or just before? 

Dr Markham: You mean PACS? 


Q510 Dr Naysmith: PACS? 

Dr Markham: Absolutely not. That is one of the 
reasons for its success, because there were such 
strong drivers as far as PACS was concerned. We 
were running out of silver films, the disposal of 
dangerous chemicals was difficult, the paper films or 
the hard copy films used to get lost, you had to have 
people carrying them around the hospital in great 
big bundles, so to have it electronically— 


Q511 Dr Naysmith: So there was not any need to 
convince radiologists that their system was out of 
date? 

Dr Markham: Quite the reverse. We spent a long 
time trying to convince trusts it was a good idea to 
have it. 


Q512 Dr Naysmith: You had to convince the trusts 
rather than the radiologists? 

Dr Markham: Oh, yes. The radiologists were 
completely signed up right from the start. We 
realised the benefits it would bring. It was obviously 
the financial drivers that we had to convince, 
because it meant new machines, which, of course, 
were hugely expensive, but eventually that was 
gathering speed. Certainly in my own hospital I have 
been working with PACS for eight years, and two 
years before that in another hospital, and it was 
extremely successful. 

Mr Burns: It would be almost impossible not to 
achieve a rapid roll-out of PACS given central 
funding. 

Dr Markham: Absolutely. 

Professor Feehally: And not just radiologists; other 
clinicians. We had a form of PACS in place for over 
a decade. It was absolutely fantastic, it works, and 
so there is never an issue about needing to persuade 
anybody. It was almost there in a way; it simply had 
to be rolled out. It was not a magnificent design 
achievement, I do not think. 

Dr Markham: No, and in fact I was at a meeting 
earlier this week and it was said that PACS roll-out 
would have happened probably without NPfIT 
because there were such strong drivers. 


Q513 Dr Naysmith: How do we get that sort of 
enthusiasm there obviously was for PACS to operate 
for other PAS systems? How do you get clinicians 
involved in customising their local system? 


Dr Markham: We have already talked about the 
obvious advantages of communicating with general 
practitioners and within hospitals, but the 
frustration has been trying to get the software and 
the hardware to do what you want it to do efficiently, 
and also a very important point is the actual 
technical back-up when things are implemented. 
Inevitably with computers things go wrong, and you 
need someone who is knowledgeable who is there. 
Your home PC might crash and you just reboot it, 
but you cannot quite do that when you have got 
electronic systems in a hospital. 


Q514 Dr Naysmith: You need the experts to talk 
with the clinicians closely on what is happening and 
what is required? 

Dr Markham: Yes, and that has been in very short 
supply. 

Mr Burns: It is availability and speed of 
implementation. If you want a PACS system, they 
are available; you can buy them off the shelf. You 
can say to clinicians, “Here, I have got some money. 
You have been asking us to put in PACS systems for 
the last decade and now we have got some money 
and you can have it in the next six months”, so you 
get a huge surge of enthusiasm from the radiologists 
and the other clinicians because they know the 
technology is available, they know it has been 
funded and they know they can have it within the 
next 12 months. On the other hand, if you are 
waiting for the clinical management systems that 
support the work of diagnosis, treatment and 
therapy, the message to the clinicians is that we will 
be putting PAS systems in (which are not clinical 
systems) for the next two, three, four years and we 
are still developing. At least probably two-thirds of 
the country is still waiting for the clinical system to 
be finally developed, and the latest estimation— 


Q515 Dr Naysmith: Does the same thing apply to 
Patient Administration Systems, or is that a different 
problem? 

Mr Burns: No, the NHS has been putting Patient 
Administration Systems in for the last 20 years, and 
most hospitals have already got them and had them 
and embraced them. What they are getting is new 
Patient Administration: Systems that are compatible 
with the clinical systems that have been purchased 
through the national clinical contract which they are 
compelled to have and must wait for, and that is the 
source of most of the frustration. The Patient 
Administration System is not the clinical system. 


Q516 Dr Naysmith: But consultants at the 
Homerton were booking people into out-patient 
clinics months in advance. 

Mr Burns: Yes. A Patient Administration System 
can help you book patients, but it does not help the 
doctors and nurses in terms of their day-to-day care 
of patients, the real purpose and benefit of this 
technology ultimately. 

Professor Feehally: We have talked about engaging 
clinicians by giving them something better, but there 
is another point that some of us are concerned that 
we might lose what we already had. We have used 
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computer systems in kidney units for 20 years and, 
although they look a bit clunky, actually they have 
got all sorts of very bespoke functionality which we 
need to use in our every day clinical work. So part of 
our discussion with Connecting for Health was, “If 
you are going to give us something wonderfully new, 
do you understand what we already have so that we 
will even have that, let alone something better?” and 
they have never discussed that with us. So, we have 
been sitting with our so-called Legacy Systems (in 
the current jargon) thinking, “Are they even going to 
take this away from us, because it would be 
unacceptable?” We have never had _ those 
discussions. 

Dr Markham: That has happened in many areas, 
that systems that were working have had to be 
removed. 

Mr Burns: Certainly in my hospital we had a very 
sophisticated, fully functioning clinical system for 17 
years. It is still the most sophisticated clinical patient 
management system in the UK, in my view, and, in 
my view, what is eventually produced by NPfIT will 
not be as sophisticated, which is the reason that in 
my trust, for issues of patient safety, we had to say 
that the first offering for NPfIT would have been a 
positive danger in that all our 6,000 staff have 
become familiar with using a sophisticated clinical 
patient management system and we have been 
offered something much less sophisticated. 


Q517 Charlotte Atkins: Based on that comment, Mr 
Burns, I am assuming that you hold to your view in 
2002 that contracting out nationally would be a 
disaster. If that is the case, can you indicate if there 
have been any successes, in your view, in the national 
programme? 

Mr Burns: Yes, they have secured £12 billion, which 
is an enormous success, and it is the most 
fundamentally important thing about the national 
programme. There is huge resource available that 
was not previously available and, despite what was 
said at previous sessions about the lack of progress 
prior to NPfIT, the biggest obstacle to lack of 
progress prior to NPfIT was the absence of resources 
on the scale that are available to NPfIT. They have 
huge sums of money at their disposal which, if 
deployed in the right way---. I think there is a proper 
argument to be had for contracting nationally, but I 
think there is a way of contracting nationally using 
all the economies of scale and using all the purse- 
string muscle that comes from _ contracting 
nationally. I absolutely agree with that. I think they 
did a super job. I think what they might have done 
was contracted nationally a catalogue of products 
which could then have been picked from locally and 
the prices could have related to how much 
penetration the different suppliers achieved across 
the NHS. That would, if you like, combine the 
benefits of national contracting with---. It is a 
framework contract. It has been done in many areas. 
You contract nationally with a range of providers 
but they then have to compete in terms of how they 
present their products to potential users to 
determine what share of the market they get. I think 


that would have been a much more successful model, 
and I think we would be much further on if we had 
adopted that sort of model. 


Q518 Charlotte Atkins: I think you argued that you 
wanted to make local chief executives accountable 
for delivering the new systems. 

Mr Burns: Yes. 


Q519 Charlotte Atkins: Do you think that would 
have resolved many of the delays we are 
experiencing now? 

Mr Burns: From where I sit, and I have been a chief 
executive for a long time, the introduction of NPfIT 
and the central contracting and the contracting with 
local service providers to be responsible for 


implementation, for taking all the risk of 
implementation, completely removed from 
operational chief executives any sense of 


accountability for delivering this programme. Poor 
old Richard Granger gets blamed for everything to 
do with the failures of this programme, but that is 
because there is no other accountability in the 
system. 


Q520 Charlotte Atkins: Is it too late to turn the clock 
back and bring in that accountability? 

Mr Burns: No, I do not think it is, but it would 
require---. Everybody wants NPfIT to succeed. The 
goals and aims of NPfIT, my goals and aims in 
relation to rolling out functional clinical IT to the 
NHS, Richard Granger himself has said that you 
could not possibly embark on a ten-year programme 
on this scale without having to change tack over the 
course of the decade and I entirely agree with him. I 
think there needs to be some decisions made as to 
how to change tack to deal with some of the delays 
that they are currently experiencing, and one way 
they might do that is to use this current OJ tender 
that they are involved in. They are currently 
involved in a tender process with the IT supply 
industry to the NHS to identify a range of products 
that might supplement what they are currently 
contracted for, and if they found a way to make the 
best of those products available as a choice within 
the NHS (and that presumably would need some 
tweaking of the contract), then I think that might 
help move things forward. I will say one final thing 
and then shut up. If there was more focus on---. You 
could give accountability to the Primary Care Trust, 
for instance. Primary Care Trusts are responsible for 
the health of their resident population. They are a 
stable part of the structure of the NHS these days. 
They could be made responsible for the 
commissioning arrangements that will bring about 
the sharing of information from systems that are 
already in place, because there are many systems 
that are already in place that could share 
information and there is no focus or requirement or 
accountability for bringing information on GP and 
hospital systems into a single view at the local level, 
and you could stipulate that as an objective so 
people could be getting on with what they could be 
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getting on with whilst they are waiting for the 
delivery of the products that would come via the 
national programme. 


Q521 Charlotte Atkins: We certainly hope that PCTs 
are now a stable part of the system? 
Mr Burns; | am sure they do. 


Q522 Charlotte Atkins: And I am sure that one of the 
advantages is that, of course, they are closely in 
touch with GPs, and I think that is one of the issues 
that we have been picking up along the way. Does 
anyone else want to come in on this issue? 

Dr Markham: On the issue of the ambitiousness of 
the thing, I entirely agree that the roll-out certainly 
of PACS has been much quicker than it might 
otherwise have been. It was happening, and it would 
have happened, and it has certainly happened much 
quicker, but to give great big contracts to a small 
number of suppliers was always going to be a 
problem because not only do they have to supply the 
machines and the software but they have also got to 
supply the personnel for the back-up of the 
installation, and that was always going to be 
challenging. One thing that we have not mentioned 
yet but has been a challenge is the fact we have no 
unique identifier in England, and that is a huge 
difficulty because we have to be terribly careful, and 
this is one of the reasons why at the moment we 
cannot share images across the borders, because we 
have not got that unique identifier. They have in 
Scotland, I understand, but not in England. 


Q523 Dr Stoate: Surely, we all have an NHS 
number. Why cannot we use that? That is a unique 
identifier: you are given it at birth; you keep it until 
you are dead. 

Dr Markham: Apparently the’ technicalities of 
issuing them are too challenging at the moment. 


Q524 Dr Stoate: One number per person up to 60 
million. Can they not count to 60 million? 

Dr Markham: If you have someone coming into A & 
E at night, for instance, badly mangled in a road 
traffic accident, you have to have that number issued 
instantly before you could image them—that is the 
challenge; it has to be like that—and you can get 
your NHS number, if they have not been imaged 
before, because it would be a bit like a grandfather 
clause. Babies could have it but people that are not 
in the system at the moment may or may not have it, 
particularly in my area of the country which has a 
high immigrant population. So the actual 
technicalities of getting it at two in the morning 
would be a problem, and there are other minor 
technical difficulties. I gather there is a push to get it 
approved, but, of course, all trusts have had their 
own numbers which they have used and they are 
reluctant, unless they have a central directive, to 
change to a new identifier. 


Q525 Dr Stoate: Can you briefly explain how 
Scotland has managed to achieve it and we have not? 


Dr Markham: | am not in Scotland, but apparently 
they have. It is called the Community Health Index. 
The Chief Medical Officer, so I understand, has 
decreed in the middle of last year that this is what 
should be used, and I understand it is working well 
from my Scottish colleagues. 


Q526 Dr Stoate: I just do not understand what the 
difference is between a Scottish unique identifier 
based on a patient and an English unique identifier. 
Dr Markham: What they have used in Scotland is 
the date of birth with four digits after it, and they are 
assured that that is unique. What is more, when 
England does get one, which we sincerely hope it 
will, then it will not overlap, so there will not be a 
conflict of people who go across border for 
healthcare, but that, I understand, is the problem. 


Q527 Chairman: Can I ask a question, Mr Burns. 
You said earlier that PCTs are a stable part of the 
structure these days. NPfIT has been around for 
quite a while now, and we have had not just the 
restructure of Primary Care Trusts but particularly 
the restructure of SHAs. We have now got the LSPs 
that are delivering in the new restructured SHAs. In 
your view has that been one of the problems of 
getting cohesion with in terms of the national 
programme, that there has been this restructuring 
inside the National Health Service, particularly at 
SHA level, or it did not matter? 

Mr Burns: | do not think so. I think the reasons for 
the slow progress are the reasons that have been 
discussed. It is to do with the national contracting 
model. My point is that I have a fundamental view 
that there needs to be a genuinely local approach to 
the development of clinical IT, because that is where 
most healthcare occurs. There needs to be some local 
accountability for ensuring that patients have 
reliable records and for ensuring---. PCTs at the end 
of the day are responsible for commissioning 
healthcare. They are responsible for commissioning 
healthcare from providers who are competent, who 
employ competent staff and who have competent 
and up-to-date systems running their organisations. 
If it was the PCT, for instance, that was responsible 
for managing the public debate about information 
sharing, as I have said in my evidence, this 
Committee has spent a lot of time discussing security 
and I think it has spent so much time discussing 
security because of the plan to build a clinical 
database at national level; I think that is the only 
reason you have been having the debate, because 
they have gone for a national model with the 
Summary Care Record. If they pursue a local 
approach to development of a Detailed Care 
Record, which would resolve the problem of local 
access for emergency records, I think the local 
debate would be entirely different because you 
would be able to explain to people why their own GP 
needs to share information with a specialist at the 
hospital to which they are being referred and why 
those two individuals need to share information with 
the Macmillan nurse, the nurse specialist, the 
respiratory care nurse, whatever the professional, 
because they can understand the context, because 
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the context is for their own care in the local 
healthcare system, and in that context I think the 
public would be much less concerned. In fact, our 
experience is that the public expect that we do that 
and they are quite appalled that we do not, and the 
one thing that the public do constantly get 
absolutely sick and tired of is ricocheting around the 
local healthcare system from the specialist hospital 
to the general hospital to the GP to the nurse 
specialist telling them the same story time and time 
again and finding doctors relying on them, as was 
evidenced before, to give them information about 
what happened the last time they saw a doctor. It is 
a complete indictment of the lack of progress with 
support in the clinical process with information 
technology. So, I think if the discussion about access 
to records out of hours, shared records was all in a 
real world context of a local healthcare system, I do 
not think you would have had the debate that you 
have had about security. It is because somebody is 
wanting to do this through a national debate that 
you then have to have a national debate about 
security, and if you have a national debate about 
security, then you find yourself talking to national 
experts on security who, in my view, could spend 20 
years in a locked room and never come up with a 
solution to perfect security. 

Professor Feehally: Two comments on_ local 
accountability if I could. Firstly, 1am not sure PCT 
is the right level. What it has to be is a local health 
community which is big enough to reflect where 
people with chronic conditions are looked after, 
which is primary care and often a number of 
hospitals over quite a wide patch—that is where you 
need to get the accountability that they will work 
together to solve that—but I absolutely agree with 
the point about people’s understanding of the 
necessity of this as opposed to the risks of this. I will 
leave you a single example. In Salford, where I know 
they have put in a clinical management system, 
which they have done themselves, nothing to do with 
Connecting for Health, they started in diabetes and 
they now have a system across the whole of primary 
and secondary care for everyone on the diabetes 
register, everyone on the coronary heart disease 
register, everyone on the chronic kidney disease 
register. They had patient engagement while they 
designed it, they asked everybody on those registers 
if they were willing for their data to be in and there 
were no refusals; so that makes the point exactly. If 
people understand this is about their local 
healthcare, it is completely self-evident that they 
would want to be on that record, whereas if they 
think their data is going to some vague national 
space where somebody they do not know might use 
it, they get sometimes anxious. That is a very 
important point. 


Q528 Chairman: I assume, on that basis, that you are 
largely in favour of using information technology 
for chronic disease management. That is one of its 
great potentials. 

Mr Burns: Absolutely. Given the amount the NHS 


has to spend on chronic conditions, in that sense it is 
its greatest gain, both at the individual clinical level 
and in terms of the use of NHS resources, by far the 
greatest gain. 


Q529 Mr Campbell: Mr Burns, you have touched on 
Detailed Care Records, but can I press you a little bit 
further. You said, instead of having electronic 
patients record, we should have detailed electronic 
patient care management systems. Can you explain 
what that actually means? 

Mr Burns: Yes. | will try and give you an example. 
In my own hospital, for instance, my own former 
hospital—I was there a long time—we had a system 
whereby, for instance, if a radiologist reported 
something sinister on an X-ray she could use the 
system to automatically alert the relevant clinical 
nurse specialist, who would then take steps to make 
sure that patient was seen in the chest clinic. So, this 
is the technology actually not just recording what 
has occurred but helping in a proactive and positive 
way the proper management of that patient. 
Another area, if you said to me, “Which is the single 
biggest clinical benefit in my view of proper clinical 
management systems?”, I would say electronic 
prescribing systems in hospitals, which are as rare as 
hen’s teeth at the moment in the NHS, but the 
Department’s own evidence to you gives you some 
very graphic statistics about the amount of harm 
that comes to patients from prescribing errors or 
poor prescribing or prescribing where there are 
contraindications for prescribing. When you have 
paper systems the doctor literally, with what is in his 
own or her own head, writes a prescription. If you 
have got an electronic prescribing system that has 
some intelligence attached to it and you write a 
prescription for something and that system knows 
that the patient has got diagnostic results that 
suggest that that prescription might be 
contraindicated, then the system will tell the doctor, 
or can tell the doctor, or the system can say, “This 
medicine should not be prescribed to patients with 
these contraindications”, or the prescribing system 
will automatically compute the dose for prescribing 
for children where body mass is important and 
many, many errors are made. I wish more people 
would spend more time looking at the website of the 
National Patient Safety Agency and look at the 
detail of the adverse incidents that occur in the NHS, 
a huge number of which, in my view, relate to poor 
sharing of information, the absence of information, 
the misreading of information. A huge amount of 
that could be eliminated by the use of proper clinical 
management technology. All that is different from 
simply providing a record of something that 
happened historically. 


Q530 Mr Campbell: That is all local stuff, and I 
understand where you are coming from, but then 
again, if we look at the element of NPfIT which is 
furthest from even getting started along with the 
local, they are not on the planet at the minute. How 
do you get them brought together? 
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Mr Burns: Yes. What I have just described, very 
inadequately, because I am not a doctor, and I am 
sure my colleagues could give better examples, is 
exactly what the clinical staff in the NHS are looking 
for—systems which actively support their care of the 
patient, not just things that passively record what 
they have done to the patient. But even the passive 
recording and the instantaneous availability of what 
has been done to a patient to everybody else that is 
looking after that patient is part of the process of 
providing safe care, but it is the absence of those 
systems at the moment, especially in the hospital 
setting, that is creating the clinical cynicism and 
disengagement, in my view, but I defer to my 
medical colleagues here. 

Dr Markham: Perhaps another example is, for 
instance, if I do an ultrasound scan I see a liver which 
looks abnormal. Now, this actually might be normal 
for the patient. If I had access to a blood test, or if I 
knew something in the past history, I could instantly 
look at that and say, “Yes, okay, that is relevant. 
This does need further investigation”, or I could say, 
“Oh, that is because the patient is slightly obese.” I 
would have access to the information that would tell 
me that. In other words, it is information that is 
there that might not originally have been thought to 
be relevant but I can get access to the information 
that way. Does that answer your question? 
Professor Feehally: Let me give you another 
example, a simple one. It would be great if I could 
access the GP system and when the patient sits in my 
clinic know what medicines they are actually taking 
and know about the blood test result from last week, 
but even better would be the patient sees me in the 
clinic, I need to adjust the blood pressure medicine, 
I make the dose change on the computer so it is 
immediately in the GP’s surgery, but, further more, 
that patient needs a blood test in two weeks to ensure 
that the change in blood pressure medicine does not 
upset the kidneys. I put that on the computer. At the 
GP’s surgery when they open up the system the 
following morning there is a flag that says, “Mr 
Smith: blood test 14 December”. It will happen. It is 
moving from information through to clinical 
management. That is what you are after. 


Q531 Mr Campbell: That is what we are hoping for 
and we are hoping at the end of the day we can work 
locally and nationally, but the indications are that it 
is not quite happening at the moment. I do not know 
whether it is teething problems. Will it happen? 
Professor Feehally: \t will happen more quickly with 
local accountability. I am absolutely sure of that. If 
the local health community for the last five years had 
known they had some opportunity for resource to do 
the things they were wanting to do anyway, as Frank 
said, if we had seen a bit of the 12 billion, I think 
there would have been real local progress already. 
Not to the level I have described perhaps, but 
something which generated momentum and 
excitement and expectation amongst the clinical 
community. 

Mr Burns: There is no doubt that the contracts that 
NPfIT have led have the intention to deliver those 
sorts of systems, but whether they will be as 


sophisticated by the time they are delivered, because 
they are being delivered over an extended period of 
time and requirements will change in the meantime. 
I think the real fear is that there is a frustration that 
what we have described is not yet available and looks 
to be many years away in some parts of the country, 
and that is not an overstatement, and there is a 
secondary fear that when it arrives, because it is 
being provided to hundreds of organisations—it has 
to be a common system for hundreds of 
organisations—ff it is not quite what people want, it 
will take another three years to get any fundamental 
changes made to the configuration or functionality 
because it is being implemented over such a large- 
scale. 


Q532 Mr Campbell: Is that the problem? It is such a 
large scale. It is too big? 

Mr Burns: Yes, | think so. There is a counter view, 
and they have the counter view, there are many other 
people and it is laced through all the evidence you 
have that many people think that the schedule of it 
was too ambitious. It is an impractical scale on 
which to implement something as complex as 
supporting clinicians in their day-to-day work. That 
is a common view. It is not the only view; there are 
other views that if contracts on a national scale---. I 
think that is a legitimate view but it is undermined 
if what you are contracted for is not delivered very 
quickly and is not very good when it is delivered. 


Q533 Dr Naysmith: What sort of conversations do 
you have with Richard Granger? 

Mr Burns: | have never had a direct conversation 
with Richard Granger. 

Dr Naysmith: I think that is a pity. 


Q534 Chairman: Can I ask you a related question? 
You were on this system—you have now retired but 
it is still your hospital, the Wirral—that your 
clinicians are very happy with and obviously we have 
not seen it, or any evidence of it, but it is managing 
patients, it is good for patients as well as good for the 
clinical staff who are working there. Did anyone ever 
ask you whether NPfIT would be compatible with 
your system or your system compatible with NPfIT? 
Mr Burns: No, but given that the model they went 
for---. The fact is all this conversation started on the 
basis that they went for a national contract which 
was bound to leave them with huge problems of 
inter-operability between the large amount of 
computing capacity that was already in place, 
despite what is being said to the contrary, and the 
systems that were secured. That was always 
inevitably going to be, and they must have known 
that and they must have factored that into their 
calculations and timescales and all the rest of it. 


Q535 Dr Stoate: I am very interested in looking at 
the level of detail required for you to do the sort of 
job you are proposing. You are seeing someone in 
the renal clinic with diabetes and many other 
complex health problems and you are suggesting 
that you have access to a significant chunk of the 
record. Are you saying you want to see exactly the 
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same record that the GP has in front of him when 
you see your patient in that clinic? All I am looking 
at is the level of detail you need. 

Professor Feehally: | cannot see any reason not to 
really, because you merely add complexity by 
excluding bits, and it will be multi-screened. I will 
not go to the gynaecology page because it will not be 
a particular issue for me, but I cannot see why at the 
local level one should not share all the information. 
The notion that the primary care would withhold a 
bit from me would be as odd as the fact that I might 
not know there was an orthopaedic operation last 
week on that patient. It seems to me that open 
sharing of information for those involved in direct 
clinical care from first principles would be right. 


Q536 Dr Stoate: I happen to agree with you. lama 
practising GP and I would be delighted for you to get 
involved in adjusting somebody’s dose of 
medication, because at the moment what happens is 
that you would write me a letter, I would get that 
letter probably a fortnight later, by the time it has 
been typed in your hospital department. It gets 
scanned in by one of my receptionists and then 
shredded and ends up on the patient’s record as 
effectively a photograph. I have then got to read that 
photograph manually, find out what you suggested, 
enter that manually onto the patient’s record and 
then take the action a fortnight later, which actually 
is prone to so many steps of error it does not bear 
thinking about. 

Professor Feehally: \t is self-evidently the right way 
to go. I do not think there is any doubt about that. 


Q537 Dr Stoate: The question I want to ask now is 
how close are we realistically to that? Is the 
programme even heading in that direction or are we 
miles off course? 

Professor Feehally: 1 think it is heading in that 
direction. I am aware that, for example, the clinical 
manager tool, which is one of the interim solutions, 
which is the one that has been put in in this Salford 
application I described, does pretty much most of 
those things. I have seen it in action just as an 
observer and you can get that kind of information 
and you can talk to each other in that kind of 
electronic way. I think there is the potential to do it, 
but it is back to this problem of national solution 
rather than getting people to do things locally: 
because if we were in the same health community we 
would self-evidently want to engage and make it 
happen. At the moment, in so many places, people 
still have this helpless sense of waiting for the 
solution to be given to them to then implement. That 
is the way it is done. 

Dr Markham: There is a good example of what is 
happening at the moment. There is a lot of effort 
being put in to a common request form for Choose 
and Book and in this there is an argument about 
what questions should be filled in by the general 
practitioner and what will be needed. The good 
example is MRI imaging. It is becoming clear that 
we need to have some knowledge of the renal 
function of a patient. If we had access to the general 
practitioner’s records or, indeed, the records for the 


local hospital, we could look it up ourselves when we 
needed it rather than relying on the general 
practitioner going through his records and putting it 
down on a national request form. So, that is a good 
example of where this huge amount of work is going 
on at a national level for this, which would not be 
unnecessary. 

Mr Burns: There are examples, it depends what 
degree of integration we are looking for, but we have 
to work on the basis that a move---. If this is an 
incremental thing, I suppose it is part of the 
philosophical debate here about whether you go for 
big bang national solutions or incremental growth 
from local systems, but there are places in the 
country where they are uploading to a different 
information system from GP systems and the local 
hospital systems on a 24-hour cycle so that GPs and 
hospitals in that community can see that integrated 
information, and there is local agreement amongst 
the clinicians about what the clinicians usefully want 
to see from the record of the general practitioner. 
There has been a local discussion about what the 
local GPs would like to see of the hospital record and 
what the specialists would like to see of the GP’s 
record. Some people would disagree with my 
colleague about the need to see absolutely 
everything, and, in fact, it may well be that that 
would make the debate about confidentiality a bit 
more problematical if, for instance, social care 
records or family histories or stuff in the GP record 
that could usefully stay in the GP record was 
available outside, but all of that can be agreed 
locally. The debate could be had locally with the 
community about what should be on the shared 
record. It would give the community a greater sense 
of influence over that process. There are structures 
in place for those debates at a local level, the Local 
Overview Scrutiny Committee, where you get some 
democratic influence on these decisions, and we have 
done that on the Wirral. There was a debate, the 
Local Overview Scrutiny Committee was involved, 
there was an agreement or an explanation about 
what would be shared and why it was being shared. 
We did develop a publicity campaign in the local 
community and virtually nobody objected. 


Q538 Dr Stoate: You talk about expert prescribing 
systems which actually we have been using in general 
practice for years. 

Mr Burns: Indeed you have. 


Q539 Dr Stoate: Why is it then so difficult for the 
hospital simply to replicate what GPs have had on 
their desks for a long time? What is the problem? 
Mr Burns: | do not know. The processes are 
different. 


Q540 Dr Stoate: Why? When I prescribe a drug, lots 
of menus come up, but one of the menus is the 
interactions, which you cannot get past—you have 
to okay the interactions screen before you are 
allowed to proceed—and if it is a high level 
interaction, for example, Methotraxate or a 
complicated drug, you have got to go through 
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several steps before the machine will allow you to 
prescribe because of the level of interaction. That is 
not complicated. Why is it different? 

Mr Burns: One of the difficulties is that most of the 
prescribing in hospitals is done by doctors in 
training, not by fully qualified people, so there are 
safeguards that you need in place to support that, 
but electronic prescribing actually provides greater 
safety. It has always been the most difficult nut to 
crack. 


Q541 Dr Stoate: But why? I still cannot get round 
why. 

Mr Burns: \t is partly to do with the leadership, and 
my two colleagues here might not agree with me, but 
it is partly to do with the resistance of senior hospital 
clinicians to the introduction of changes to their 
working processes that fundamentally affect them 
directly and require them to, if you like, action the 
prescription, and understandably so. As you 
know—you are a doctor and I am not—you can do 
a lot of harm with drugs, and, therefore, it takes an 
awful lot of persuading for a community to see its 
clinicians move away froma tried and trusted system 
to one where they are relying on a computer. 


Q542 Dr Stoate: It has been tried and found 
wanting, because the current system— 
Mr Burns: The current system is a disaster. 


Q543 Dr Stoate: The National Patient Safety 
Agency will tell you that there are hundreds and 
thousands of mistakes each year. 

Mr Burns: | agree. 


Q544 Dr Stoate: So, the current system has been 
tried and found wanting? 

Mr Burns: There has not been enough will, either 
managerially or politically. It is not a priority of 
NPfIT, and it should be one of the first things that 
are rolled out across the hospital service (electronic 
prescribing), but there is not the managerial or 
political will, and I think there are also issues about 
the numbers of systems that have cracked the 
particular way in which hospitals need to prescribe. 
Professor Feehally: As you might expect, I am still an 
enthusiast of such systems, and some of those points 
may be true in some trusts and also a simple one 
which comes back to money. There are so many 
things we would have loved to have done over the 
last decade in IT development in hospitals for which 
there was also no resource, and there is still no 
resource because it is sitting nationally. I have no 
doubt at all that with the dispensation of some of 
that resource locally you would have seen a lot of 
change in growth. 

Mr Burns: It is interesting that the Department of 
Health evidence in which it extols the importance of 
using IT and the importance of the work that NPf1T 
is engaged on quotes directly the benefits of 
electronic prescribing. As far as the hospital side is 
concerned, electronic prescribing is the very last in 
the list of things that are going to be delivered by 
NPfIT, and there are people who fear they will never 
ever be delivered? 


Dr Markham: Can I come back to one of the 
problems which I think may be behind this. I have 
alluded to it before. It is the lack of back-up of IT 
staff within trusts. The PACS system has just been 
rolled out across my trust and we have had three 
people who have been across three different sites 
with about 20 different consultants, let alone 
hundreds of radiographers trying to use the new 
system, and they are extremely stretched; whereas | 
think in general practice you have got much more 
direct access to the people that are sorting out the 
system. Certainly when you sit there and something 
does not work, you ring them up on their mobile and 
you find that they are at the trust four miles away, 
and that has been a big barrier to convincing staff at 
the hospital that this is definitely the way to go and 
this is how they should do it. It really is quite 
frustrating when you know all these wonderful 
things that you could be doing but your brake is the 
lack of IT back-up because of the lack of staff and 
the expertise available, I suspect. 


Q545 Dr Taylor: Anybody listening today and 
reading a lot of our evidence would think that the 
only good thing NPfIT has done is to produce 12 
billion. I want to try and explore the ways in which 
it has delayed things. Is it fair to say with electronic 
prescribing in hospitals that many hospitals were on 
the verge of doing this quite some years ago and that 
this is one of the things that NPfIT has delayed? 
Mr Burns: | would not say that. To be fair to NPfIT, 
I think introducing electronic prescribing into 
hospitals—take it from me, I have been there—is a 
really difficult challenge, because there is so much 
nervousness around switching prescribing to 
electronic systems. It is worth the effort in 
persuading people, because the systems are so much 
more reliable and safer, but it is very difficult and I 
do not think it would be fair to say that we would 
have wall to wall electronic prescribing in hospitals 
if it had not been for NPfIT. I think that would be 
unfair. 


Q546 Dr Taylor: At Homerton we learned last week 
that, although they have got a pretty good system, 
that was the one thing they still did not have. Going 
on to the radiology front, I know that CT scans have 
been available at the local neuro-surgical unit for 20 
years plus. Did you say that that was being 
jeopardised or put back by NPfIT in any way? 

Dr Markham: There is no doubt there is a difficulty. 
The arrangement for the clusters, which was 
NPfIlT—these are the areas in the country that have 
had the providers and they are the areas that have 
been rolled out—London is one, the South of 
England is another, the East is another, and that side 
of things going nationally has jeopardised things 
that were already in place. For instance, apparently 
there was a thing before I was in the South of 
England called the Shire’s Consortium, and that was 
a very co-operative area in the South of England 
which was ready to go on PACS, communicating 
between each other, and that was stopped because 
they had to go on to the NPfIT system. It has rolled 
out very quickly, and I think parts of the country 
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that were not as well organised as that, I think it has 
speeded up with the availability of the finance, but 
there is no doubt there have been instances. For 
instance, only just now Truro can now communicate 
with Plymouth and back, whereas before they could 
not communicate quite as easily, but that has 
stopped for a while before it has got going again. 


Q547 Dr Taylor: Coming back to PACS, because we 
have talked quite a bit about it, it has been available 
since the early 1990s. 

Dr Markham: Yes. 


Q548 Dr Taylor: So where has the delay come on 
that? 

Dr Markham: Part of it was computer technology. It 
very much developed in line with computer 
technology and the storage available, and the 
acquisition of the images and the storage of the 
images, if you like, did not roll out as quickly, but it 
was very much financial and convincing people who 
had machines that produced hard film that they were 
going to have to ditch all that and go electronic. That 
was a big financial investment. Once the advantages 
were realised, once the radiologists convinced the 
trust that this would be a great advantage, and the 
clinicians, because they are now entirely 
enthusiastic, they have got their work station in the 
clinic and they can see the images and they can see 
the reports and that is great, but it took a lot of 
convincing, I would say it started to roll out towards 
the middle late nineties really. 


Q549 Dr Taylor: I think it was the intention that 
PACS should be available nationally. Would that 
have been a good thing? 

Dr Markham: Y ou mean connecting up nationally? 


Q550 Dr Taylor: Yes? 

Dr Markham: Yes. There is no doubt it would be 
useful. It is a question of where your priorities are, 
but, as one of my colleague said before, the vast 
majority of health interactions are relatively local 
and, yes, you do get people going down to the South 
West for their holidays and their care is maintained 
back at base in Newcastle, or wherever, so there will 
be instances where it is useful, but what has 
happened at the moment is, largely because of this 
unique identifier, you cannot transfer images like 
that; and there is an enormous industry at the 
moment with people burning CDs, putting the 
images onto CDs that then get sent to the hospital 
that might be two miles down the road and then they 
find they cannot open it because the technologies are 
not compatible to open it, or there is some problem 
or other, and then they have to ring up and say, “Can 
you tell me over the phone what the report was?” All 
that type of thing is, in my mind, much more 
important than the relatively small number of 
people who will be going from one end of the 
country to the other. 


Q551 Dr Taylor: Is the roll-out of PACS pretty well 
complete now or are there places that still— 


Dr Markham: Yes, the North West and the West 
Midlands is delayed, because there were some 
contractual problems initially, I believe, but I think 
about 70/75% of the country is now covered. The full 
potential is not there just yet. One of the difficulties 
that was perhaps mistaken at the beginning was that, 
although the PACS image thing was national, the 
radiology information systems were not and the 
interface between those has been challenging. So, 
although the images were okay, you were trying to 
interact with your previous films and your previous 
demographics, and that is still a problem in many 
places and many places have a_ radiology 
infrastructure that does not match. 


Q552 Dr Taylor: Have old films been archived 
digitally? 
Dr Markham: Many have, yes. 


Q553 Dr Taylor: So the old X-ray departments and 
stores of X-ray films in the cellars and things are 
gradually going, are they? 

Dr Markham: Gradually going is the way to describe 
it, yes, absolutely, and the vast majority of previous 
images are not accessed after about three years; so 
inevitably we will get less and less. 


Q554 Dr Taylor: Obviously PACS has changed the 
way radiologists work. Has it changed the way other 
clinicians work? 

Dr Markham: We believe so, because they, again, 
have instant access to the images. A patient can go 
from A & E, a film is taken and immediately, without 
the patient having to come back again, the image can 
be there for the doctor to look at. My colleague will 
obviously be able to tell you better, but certainly our 
clinicians are very enthusiastic about it. 


Q555 Dr Taylor: Have you got the ready availability 
of X-rays in all your clinics of any of your patients 
all the time now? 

Professor Feehally: It works. It makes a clear and 
unequivocal difference. It improves patient care. 
Jim Dowd: I would refer to the questions on PACS, 
but I think they were covered more than adequately 
in the early part of the session and so I will not delay 
you any further. 


Q556 Chairman: I questioned you (I am talking to 
Frank Burns now) about the issue of what happened 
on the national organisation, as it were, versus a 
local Detailed Care Record in many circumstances. 
I know you have retired now and I do not wish to 
upset you in any way, but if you were in charge of 
Connecting for Health tomorrow what immediate 
changes would you make to the organisation of the 
national programme? 

Mr Burns: | am not ducking that question, but I 
think a lot of this depends on the nature of the 
contract that has been struck. If you are asking me 
what my wish-list would be, that is a different 
question to what is practically possible, given that 
there are contracts in place with the LSPs and with 
software suppliers. I suspect and I hope that it would 
be possible---. Without that knowledge about what 
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the contracts allow for, certainly in some parts of the 
country that depended, for instance, on hospital 
system software that is not yet developed, not yet 
available, may not be deployed in terms of the 
clinical functionality until we are into the next 
decade, if that is the realistic position (and it looks to 
be the position for some parts of the country), then 
I would think it absolutely imperative that some 
options are made available to those parts of the 
country, that some way is negotiated, either on an 
interim or on an entirely permanent basis, to give 
parts of the country with excessive delays in the 
availability of clinical functionality and resources—. 
The resources are all locked up in NPfIT, and that is 
the problem locally. Nobody can do anything 
because NPfIT has the money. I would look for a 
way of making resources available in those 
communities that have got an unacceptably long 
time to wait for clinical systems and try and find a 
way of giving them choices of clinical systems. There 
is a supplementary contracting process going on, as 
I alluded to before, where NPfIT is identifying IT 
suppliers with systems that I think are described as 
“step-in systems”, so they have systems, if you like, 
on the shelf if they have problems with current 
suppliers. I would move from “step-in” to 
“alternative” in circumstances where the delivery of 
clinical functionality is unacceptably delayed. I 
would certainly want to look at why—. There are 
parts of the country where they have procured a 
system that is up and running that does have decent 
clinical functionality but does seem to be taking an 
age to be implemented, and you would certainly 
want to have a good hard look at implementation 
timescales in those parts of the country where 
potentially decent systems have been procured, and 
there certainly are parts of the country where that is 
the case. I think the other thing I would do would be 
to make PCTs, as they are accountable for the health 
of their populations, accountable for commissioning 
arrangements to allow information — sharing 
electronically between the organisations that they 


contract with for the care of their residents. In other 
words, I would introduce a local focus on the sharing 
of information and, if you like, remove any obstacles 
to the procurement of technology that maximises 
inter-operability between existing system and allows 
information sharing between existing systems. I 
think the structure of the contracts makes that very 
difficult currently. 

Dr Markham: If | had a wish, the unique identifier, 
because until that is in place---. For instance, there is 
a trust down the road with extra capacity. They 
could do some of our reporting if we could send the 
images. We cannot do that until we have a unique 
identifier, and also the trust would need to be 
mandated to use that rather than using something 
different; so that would be a practical step forward. 
Professor Feehally: | think something that has begun 
to happen which has been almost stealth-like is 
worth commenting on, because for so long from our 
perspective we were told that the national 
programme would deliver everything and we would 
have a system that would replace everything. Now, 
as you have heard, within the last few months there 
is a tender out for so-called additional services 
capacity, which are effectively interim systems which 
will be compatible with the final solution, which is a 
recognition from them that they cannot do 
everything. That is fine, but they need to be talking 
to people like us about what are going to be in those 
interim systems and people like us need to be helping 
them to get the functionality right. So, I think my 
single wish really is communication with clinicians 
over that particular thing but, in general, that they 
come down from the mountain top and we really 
engage and they begin to learn to help us understand 
what they want to do, because we have not got it yet. 


Q557 Chairman: Could I thank all three of you very 
much indeed for coming in and helping us with this 
inquiry. I am not sure when we will be reporting to 
the House and the Government, but it I hope it will 
not be too long. 


Witnesses: Lord Hunt of Kings Heath, a Member of the House of Lords, Minister of State for Quality, Mr 
Richard Granger, Director General of IT for the NHS, and Dr Simon Eccles, National Clinical Lead for 
Hospital Doctors, Department of Health, gave evidence. 


Q558 Chairman: Good morning and could | 
welcome you to what is the second half of our fourth 
session on taking evidence in relation to the 
Electronic Patient Record. Could I ask you for the 
sake of the record if you could introduce yourselves 
and let us know what position you hold. 


Dr Eccles: | am Dr Simon Eccles and I am a 
Consultant in Emergency Medicine at the 
Homerton Hospital in Hackney. I am acting Clinical 
Director for the National Programme for IT and I 
am one of the national clinical leads for secondary 
care. 


Lord Hunt of Kings Heath: | am Philip Hunt and I 
have ministerial responsibility at the Department of 
Health for the National Programme for IT. 


Mr Granger: | am Richard Granger and I am the 
NHS IT Director. 


Q559 Chairman: Welcome. I have just got a few 
questions to ask to open this session up in relation 
to the Summary Care Record. You will have seen no 
doubt some of the evidence that we have been 
taking, both written and verbal evidence, in relation 
to this inquiry and we have heard a number of 
different answers about what information will be 
included in the Summary Care Record. Could you 
tell us definitely what will be included in the 
Summary Care Record? 

Lord Hunt of Kings Heath: Can | ask perhaps Dr 
Eccles to take that in detail. In basic terms it will 
start off with information from the GP practice 
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regarding medication, allergies and adverse 
reactions. The expectation is that it will grow richer 
in time but I think perhaps Dr Eccles might like to 
give a more detailed response perhaps about the uses 
it is put to. 

Dr Eccles: The information on the Summary Care 
Record when it first starts—as you know we are 
starting in Bolton at the moment—contains 
centrally held, specific demographic information on 
the patient, current address details, date of birth, 
contact numbers, the NHS number (which means 
you can uniquely identify individuals), contact 
preferences (including things like preferred 
language) and their consent status for the record. 
The initial upload from the GP summaries of clinical 
information is medications, allergies and adverse 
reactions. That upload is by implied consent. The 
next upload of information, following a discussion 
with the general practitioners, will be a summary of 
key medical information—past medical history, 
important procedures or operations undertaken. 
What that minimum information set contains is 
being derived at the moment by a group headed by 
an A&E consultant in Bolton using GPs, patients 
and others to derive what is that most helpful list. 
That is going to be a part of the evaluation process: 
Does that work? Is that the right list? The next 
stage—and we are still in 2008 at this point—is the 
capacity to take discharge information from 
hospital settings, whether that is in-patient discharge 
summaries, clinic discharge letters, or emergency 
department discharge summaries. So what the GP 
believes are the most important things wrong with 
you; medications and allergies; and, every time you 
have been in contact with secondary care the 
information exchange between GP and secondary 
care, what I hope, as an A&E consultant, is the most 
helpful block of summary information. If I have a 
critically ill patient in front of me that is what I 
would look for in the notes now, so that is what we 
are going to provide. 


Q560 Chairman: Is it intended to support scheduled 
care, unplanned care, or both? What is its intention? 
Dr Eccles: Its primary role is supporting 
unscheduled care so when a patient appears at a 
setting where they are not currently known and their 
main records do not presently exist—that would be 
emergency departments for the sake of speed; GP 
out-of-hours centres where records are currently 
sketchy (and there has been some recent publicity of 
some unfortunate occurrences as a result of poor 
information); walk-in centres; ambulance personnel 
and others would have access to this information. I 
can also see it being used during the transition phase 
in hospitals where you cannot get the patient’s main 
record. To have access to that summary would be 
very helpful. And, of course, it would be used where 
patients transfer over geographical distance, so if 
they are on holiday elsewhere in the country that is 
the only record you may have. 


Q561 Chairman: What about the issue of Secondary 
User Services and the Summary Care Record? 


Lord Hunt of Kings Heath: Clearly the information 
in anonymised form that becomes available could be 
extremely helpful in auditing quality and in enabling 
research to be undertaken into areas of illness. We of 
course understand that it has huge potential for 
researchers in the future. It clearly has ethical and 
practical considerations too, and we have had two 
working groups, one which has published looking at 
the technical aspects, such as anonymisation of data, 
and a second one that will shortly be published on 
some of the ethical considerations. There is a rich 
mine of information which, if used appropriately, 
could have a huge benefit in terms of understanding 
our knowledge about the quality of care but also in 
terms of research into future developments, and I 
think that secondary use is a terminology which I 
know has been commented upon. It is not a word I 
am very comfortable with. I think that treatment 
goes alongside research. One of the great strengths 
of our National Health Service has been the quality 
of its research base, it is why so much R&D resource 
is spent in this country, and I think the potential 
positive benefits that have been defined under the 
terminology “secondary use” really do go hand-in- 
hand with effective treatment and care. 


Q562 Chairman: Are patients currently in the early 
adopter schemes made aware of that? 

Dr Eccles: \t is indeed referred to within the leaflet 
on—I am_ going to seek confirmation. 
Unfortunately, I have not got it with me. 


Q563 Chairman: It is important to have a leaflet! 
Dr Eccles: It is important, if I tell you it is in the 
leaflet, to make sure that it is. 


Q564 Chairman: I will take your word for that. 

Mr Granger: The information in the Summary Care 
Record is not feeding into the secondary usage 
service; it is sourced separately. At the moment they 
are isolated. 


Q565 Chairman: Summary records could be used for 
purposes of research? 
Mr Granger: Eventually. 


Q566 Chairman: That is why I asked the question. 
The other thing, Simon, you said earlier about the 
adverse reactions, prescriptions, allergies and 
everything that will be in it. All that information will 
only be added to the record with explicit patient 
consent and patients will be able to see what is 
added; is this correct? 

Dr Eccles: Let us be clear on what is happening. The 
implied consent, the automatic update, is purely 
medications, allergies and adverse reactions. The 
reasons for particularly taking those fields is that it 
was felt from widespread medical and _ patient 
consultation that they are the lifesaving fields. 
Indeed, according to the National Patient Safety 
Agency, they are the second largest cause of adverse 
events to patients. The next step, which is the GP- 
derived summary of important health information, 
we are recommending is done in consultation with 
the patient and the patient is shown what is proposed 
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to be sent up and agrees that that is the case. We will 
be evaluating that model and that is an independent 
evaluation from University College London: Are we 
picking the right information? Is the process by 
which we are gaining patient consent the right one? 
Is it too cumbersome or is it too stringent or is it too 
lax? We think it is the right blend. 


Q567 Chairman: If you add some information about 
that patient in that area at a later stage will that have 
to be consented as well? 

Dr Eccles: What we would hope in that early 
consultation is that patients will usually—and that 
certainly seems to be the evidence we are getting at 
the moment—give their express consent “I am 
happy for you to continue to add information to this 
record unless as my GP you think it is clearly of a 
sensitive nature, and I have outlined to you that for 
example sexual health issues I wish to keep separate 
from this, but otherwise if I come in and see you and 
you diagnose me with diabetes we do not have to 
have the whole conversation again; I perfectly accept 
that that goes up to the record.” That is how we are 
expecting those conversations to take place. 


Q568 Chairman: Could I ask you what access I will 
have as a patient to my Summary Care Record if I 
agree to have one? 

Dr Eccles: This is the biggie. This is the purpose of 
HealthSpace and it is one of the biggest benefits of 
the Summary Care Record. You as a patient will be 
able to see your record and everything that is on the 
Summary Care Record for yourself via a secure 
website called HealthSpace. 

Lord Hunt of Kings Heath: Can | add to that, the 
great advantage of HealthSpace is alongside having 
access to your Summary Care Record there will a 
whole host of information about health, and my own 
view is that it has huge potential in helping people 
take control of their own health. More and more 
people are interested in health issues and we think 
this HealthSpace has very exciting potential. Having 
access to your own Summary Care Record as well 
will add to the importance of this and I believe the 
use of it by patients. 


Q569 Dr Stoate: I wanted to ask Simon about the 
logistics. You have talked about effectively sitting 
face-to-face with patients and there are going to be 
2,000 patients on average per GP. You have then got 
to sit down with the patient, discuss what the 
implications are about building the record, you have 
then got to make some judgment as to what gets 
uploaded, you have then got the logistical problem 
of actually sifting through the GP record and 
somehow moving the data from the general GP 
record into some uploadable form. All this is pretty 
resource intensive. Have you considered literally the 
pros and cons of how you are going to do it? 

Dr Eccles: My colleague Gillian Braunold thinks of 
little else on a day-to-day basis I am reliably 
informed. 


Q570 Dr Stoate: She needs to get out more, does 
she not! 


Dr Eccles: We could not do this without her. You are 
absolutely right that we need to make sure that the 
logistical process is as straight forward as possible. 
That is part of the reason for this minimum data set 
that is being gathered together at the moment by 
GPs, by patients and by A&E staff in Bolton, in 
conjunction with all of the early adopter PCTs and 
the potential early adopter PCTs. So it is not just 
Bolton. We are asking all of them to give us the list 
of what we should automatically pull from the GP 
record into what we have got on our demonstrator 
programme. It is quite a clear screen that says this is 
what we are going to send up, if it is okay with the 
patient. You print a copy of that out and give it to 
the patient, “Read this at your leisure and see if you 
are happy with it.” They have a 16-week timespan in 
which to contemplate that as a patient, approve it 
and then come back to their GP and say, “Yes, lam 
happy with what you plan to send up,” or, “Take 
some items out,” or, “Why have you not mentioned 
the back pain...” 


Q571 Dr Stoate: I am just going to stop you there. 
That is now two consultations with the GP both of 
which are quite detailed so that is half a year’s 
average GP contact time for a patient just on that 
one issue. I am very concerned and I would like to 
know what work you have done on how you are 
going to say to a GP you have got to do half your 
annual consultation with that patient on this one 
issue. 

Dr Eccles: | do not think we will, I really do not. The 
majority of patients will either be given that print- 
out or will request it from the receptionist staff at the 
front, who will hand it to them in an envelope 
without a consultation. For most they will look at it 
and say, “That’s fantastic,” and will sign it off again 
without a consultation. 

Lord Hunt of Kings Heath; \t is also worth making 
the point that we have the evaluation being 
undertaken by UCL and clearly the whole purpose 
of that is to learn lessons from the early adopter sites 
so that can then help us feed into the next stage of 
rolling out the programme. 

Dr Eccles: As Gillian just kindly pointed out to me, 
the reason we are doing it this way is that the group 
we want to get first, and most importantly, is those 
patients who have the largest body of disease 
because they are the ones for whom it will be most 
helpful for out-of-hours settings where an acute or 
chronic exacerbation of their existing condition at 
the moment results in our starting again from 
scratch and amending a carefully described plan of 
treatment that the GP and the hospital spend ages 
getting right and we in A&E, through—I would like 
to point out—no fault of our own, adjust that for the 
emergency and change it for the patient. We will 
catch them because they have many more than just 
two consultations a year. We are using diabetic 
clinics and we are using nurse practitioners, who are 
seeing patients for all of these conditions, to have 
those conversations. I do not think the burden will 
be that high. I do not know that for certain and that 
is what we will be evaluating. 
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Q572 Dr Naysmith: You will be very well aware, I 
am sure, about the concern there is about iSoft’s 
Lorenzo system. When do you expect it to be widely 
available. 

Lord Hunt of Kings Heath: Perhaps I could ask Mr 
Granger to answer the details of that. 

Mr Granger: We expect within the next couple of 
weeks the first live running of Lorenzo Version 3 
software to be working in Germany in Aachen. And 
we expect the first live secondary care versions of 
Lorenzo to be available next year in the NHS in 
England. Also on the topic of iSoft, there has been a 
lot of speculation regarding the corporate structure 
that will support iSoft in fulfilling its NHS 
obligations. The situation at the moment is that the 
organisation with whom we have a contract, which 
is not iSoft, it is in fact CSC, is in the latter stages, 
which I hope will conclude satisfactorily, of ensuring 
appropriate funding and management control to 
take the now largely completed code and to test it 
and get it into a state of readiness for putting it into 
production. I understand that an associated 
transaction involving an Australian company, IBA, 
is also near to satisfactory conclusion with iSoft and 
IBA. I would hope that those three companies will 
be making an announcement about that in the next 
few days. Should that fail, we have third party 
resource present now to take control of the NHS 
delivery components on a step-in basis under our 
contract, which will force CSC to step up to the plate 
of ensuring properly financed and managed 
completion of the Lorenzo product for the NHS. 


Q573 Dr Naysmith: The question was not so much 
about when you will have a prototype ready but 
when it would be widely available to those areas 
which are depending on it? 

Mr Granger: It will start to be rolled out next year. 
One of the challenges in healthcare IT is that it is 
pretty easy to get a good solution working in one 
hospital if you throw enough money at it, but when 
you come to re-tender that solution, it often ends up 
being unaffordable. The sites of excellence that the 
NHS had pre-2003 have all faced that challenge. 
They have run independent tests in many cases and 
the costs have been unaffordable. One such example 
is the Wirral where on re-tendering their very good 
local systems have had to go with a national 
solution, and indeed one with an American software 
supplier. In the Homerton their contract was 
transferred to BT for the same reasons—that it is 
difficult to sustain excellence even on a limited basis 
locally. We will start rolling out the Lorenzo product 
next year. I expect there will be some difficulties with 
the product in the early sites and it would be 
misleading to suggest otherwise. It will, through the 
last part of 2008 and over the next few years, then be 
rolled out across the rest of the sites that want it. 


Q574 Dr Naysmith: Are the on-going delays with 
Lorenzo your biggest problem? I know you have got 
lots of other problems. 

Mr Granger: | think the biggest problem is finding 
time to manage a Programme which is subjected to 
so much negative examination. 


Q575 Dr Naysmith: Is that not because it is not 
working? 

Mr Granger: No, I think it is because there is a lot of 
mythology being generated by people who would 
like to see it fail. 

Lord Hunt of Kings Heath: \f } could comment on 
that. Clearly taking over responsibility for this 
programme at the beginning of this year I have been 
struck by the degree of negative comment and 
clearly it is a feature of many IT procurement 
programmes, but I think if you look at what has been 
achieved over the last few years, particularly if you 
look at some of the developments that have had a 
real impact on quality of patient care such as PACS 
or the start of the electronic prescription service, or 
getting broadband connection for the whole of the 
Health Service, or a quarter of a million staff with 
their own email address on the NHS system, or the 
quality management system to enable information 
in GPs to be properly assessed, or the work we have 
done on the Summary Care Record, it is a very solid 
body of achievement. Now you are right, there are 
also challenges. We know that the Summary Care 
Record is later than we would wish but that was 
because of the extensive debate there had to be with 
clinicians about what should be in it. We know the 
challenge of Patient Administration Systems, 
particularly in hospitals with existing systems, as 
you have inferred, is a particular challenge, and we 
knew that was going to be the case. However, in 
terms of where we are, I strongly believe that we have 
a very strong foundation on which to go forward. If 
I can look back because, as you know, I have 
responsibility for IT— 


Q576 Dr Naysmith: I want to ask another question 
related to this one which will enable you possibly to 
say something else. The Millennium system seems to 
be much further advanced and seems to be working 
much better. If it is successfully implemented and 
Lorenzo is further delayed, will you allow hospitals 
outside London and the South to implement the 
Millennium system instead? Would that be a 
possibility? 

Mr Granger: Yes, definitely. One of the reasons that, 
unlike a number of other organisations, we did not 
choose a single solution from a single supplier where 
we were able to have some contingency within our 
resourcing arrangements was to deal exactly with the 
risk of supplier failure. Perhaps the best example of 
that is in the picture archiving arena where we 
initially chose an innovative product from a 
company called ComMedica to implement in the 
North West and West Midlands. Unfortunately they 
missed nine key milestones and their contract was 
terminated by CSC and they were replaced by the 
contractor GE that was already serving the south of 
England. We will by the end of this year have got 
most hospitals in the NHS running digital imaging 
systems. It is important to note that when they were 
being bought locally with 16 different systems being 
procured, most of which were not compliant to the 
standard that enables images to be read on 
competitors’ systems, in five per year were being put 
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in. We do five some weeks now, so the procurement 
model does work and it does deal with supplier 
failure. 


Q577 Dr Naysmith: It is interesting in the session just 
prior to this it was said quite clearly that there was a 
system up and running in the Wirral which is at least 
as sophisticated as what you are trying to put in 
nationally now and possibly more sophisticated. 
That was also happening at the Homerton which we 
saw last week, so what is happening in this national 
procurement programme is seeming to be blocking 
local initiatives which have been working extremely 
successfully, and perhaps this concentration on the 
national model and also on the summary patient 
record, which seems not to necessarily have been the 
most important thing, seems to be delaying progress 
rather than making it. Finally, Philip and then I will 
let you come back, if we have got large areas of the 
country which are waiting for a system to come in 
and it is not coming in because it has been 
consistently delayed and other parts of the country 
have successfully implemented useful local 
management systems, which everyone tells us is 
what is more important than being able to deal with 
the odd problem that happens when you are on 
holiday in Cornwall, this is going to be a real disaster 
for the whole thing, is it not? 

Lord Hunt of Kings Heath: 1 wonder if I could make 
some general comments and then ask my colleagues 
to comment on the specifics. The two things I would 
like to say is that I do not think we should 
underestimate the potential of the Summary Care 
Record in everyday clinical practice and not just in 
the circumstances as you have described. The more 
general point is that I look back to many years’ 
experience with the NHS’s approach to IT and the 
fact is that at the beginning of this decade, if one 
looked at what has happened in the NHS, it simply 
was not making sufficient progress. There were these 
islands of excellence. I am enormously admiring of 
Frank Burns’s contribution to that in the Wirral but 
the fact is as a whole the NHS was under-investing, 
it was developing systems that could not be 
integrated, it was very patchy in its approach, and I 
think that national approach that we have taken was 
absolutely essential in terms of ring-fencing the 
resource, giving it the priority and ensuring that the 
NHS did move in step. Clearly there will always be 
issues that individual organisations will think, yes, 
we might have done better, but I do think you have 
to look at the NHS as a whole. The way IT had been 
in the NHS over 20 years simply would not have 
done the business and that is why I am convinced 
this approach has been the right one, alongside a 
contracting regime which does transfer risk to the 
local service providers, which again is, I believe, a 
model of what ought to happen in public sector 
procurements that has not always happened with 
previous procurements. 

Mr Granger: | have just a couple of things to add. 
The Summary Care Record is going to be the first 
port of call for the 115.5 hours a week when the GP 
practice is shut, so I think it is quite a useful 
instrument to have regardless of whether you stay in 


one place or move around beyond your immediate 
place of domicile. In terms of the excellence that has 
existed in islands in the NHS, I said in 2003 that what 
we were about was trying to get that implemented in 
more places, and that remains the challenge. So 
where we only had 50 sites in the NHS with digital 
imaging over a ten-year period, we have now 
probably got less than 50 sites that do not have it. So 
it is about trying to build off those islands of 
excellence, all of which have problems with 
affordability, the standards they use and the 
extensibility of what they are doing onto a national 
basis. So you can do very, very good work with very 
good clinical engagement at a local level but every 
time those installations have come up for contract 
renewal there have been serious affordability 
problems. 


Q578 Dr Naysmith: It is not surprising if all the 
money is going into a national system. 

Mr Granger: If you look at, for example, the Wirral, 
maybe you should go and look in detail at the cost 
of replacing that system through local procurement. 
It was entirely unaffordable. The same was true of 
the Shires procurement when that was running ona 
regional basis and that was also true in Blackburn 
and Bradford. So a number of data points show that 
you cannot afford to buy these rich systems in every 
NHS site because you do not get any economies of 
scale from the supplier community. So it is not about 
all the money being spent nationally. It is about the 
unit costs being too high if things are bought locally. 


Q579 Dr Naysmith: Just finally on this, all the 
evidence suggests that if you do it locally you can 
engage the clinicians much better and this is 
something that is not happening everywhere with the 
national system. What do you say to that point? 

Dr Eccles: “You are quite right” is the one-line 
answer to that, but there is the problem we have just 
heard outlined. I am a committed fan of the idea ofa 
national programme, despite having just agreed with 
you that a system that a local hospital goes out and 
buys for itself will always be loved much more than 
one that is apparently given to them by the 
Government, however generous that may 
apparently seem. Why am I a fan of a national 
programme therefore? Because we were not getting 
on with it in the NHS. You have seen what the 
financial figures for the NHS have been like over the 
last year. Without a national programme with 
separate Treasury funding I do not think there is a 
cat in hell’s chance that we would be upgrading the 
IT systems to the point we needed to get to had we 
done it on a one-by-one trust-by-trust basis. What I 
find fascinating working at the Homerton with the 
Cerner product, and it works and it is part of our 
day-to-day functicn (you have come and seen it) is 
when I bring groups of clinicians from anywhere else 
in the south of London to have a look at the 
Homerton system, their answer is: “I want it. | want 
it right know. When can I have it? That is fine, we 
will take that product please”. It is a question of 
trying to get that clinical message back through the 
management structures of the trusts and then 
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through the Strategic Health Authorities. Do not 
strip off those clinical functions. Do not see this as 
an IT project, “Do not see this as simply a patient 
administration problem. This is better patient care 
and this is saving doctors’ time and effort, they do 
like the product. Give them the whole of that”. That 
is what we thought we were doing, that is what we 
were trying to do. Understandably, local hospitals 
reconfigure it to suit themselves and occasionally 
make a decision that I would regard as flawed, that 
they are going to just take the Patient 
Administration System, the pure IT only project and 
not the much wider clinical benefit programme that 
I think they should. 


Q580 Chairman: Could I just ask, you were the 
Minister responsible for the national IT programme 
from 1999 to 2003 and then you have some respite. 
You are now six months into your second phase, 
what have been the positives and the negatives 
coming back in again and looking at the programme 
over two years on from when you left it? 

Lord Hunt of Kings Heath: Respite including heroic 
stewardship of the Child Support Agency and its IT 
programme. I think I know a little something about 
some of the challenges of big IT programmes and I 
would draw a distinction because what it does seem 
to me in drawing parallels is that the way the 
national programme has been developed has very 
much emphasised ensuring that as much of the risk 
is transferred to the private sector as it ought to be 
and, secondly, “derisked” in terms of not going for 
heroic dates when everything has to go live, that it 
has been very, very carefully planned and executed 
and I think those are very much to the credit of the 
IT team. Iam absolutely convinced that without that 
strong national direction the NHS would be 
nowhere near where it is at the moment in terms of 
progression. There is nothing to suggest from the 
history of the NHS that left to its own devices it 
would have invested sufficiently in IT, nor would it 
have dealt with the need to ensure that there was 
integration. It is on integration that so much 
depends in terms of patient safety and quality. A lot 
of the programmes are proving to be very successful 
indeed. I have mentioned them already and I think 
that they are being used by clinicians ona daily basis. 
There is a lot of enthusiasm in parts of the NHS in 
terms of their use and implementation. I would say 
there are four major challenges. There are the two 
programmes that we have already discussed, the 
Summary Care Records and the Patient 
Administration Systems particularly within 
hospitals, and clearly those are major challenges. I 
am sure that it was right to spend more time 
preparing the ground for the Summary Care 
Record. We will see the results of the evaluation but 
I believe that was time well spent. We have seen too 
many IT programmes in the past where an over- 
ambitious target has been set, it has been introduced 
too quickly, it has not got ownership amongst the 
people involved, and the technicalities will often not 
be right. On the Patient Administration Systems, 
this is a huge challenge. It was never going to be easy 


for hospitals to change from their current multi- 
faceted systems, if I could call it that, to the new 
systems but again it is working through. We are 
seeing systems delivered quicker and the next two or 
three years will see a huge advance. The two other 
areas that I would identify as really major areas for 
my own attention are the issue of clinical buy-in that 
Dr Naysmith referred to and the issue of local 
commitment by the leaders of the NHS. On the 
clinical buy-in we now have a very good programme. 
In the National Programme a lot of clinicians are 
involved. They have an essential role to play. 
Equally, the Committee may recall that going back 
to the beginning of the national programme I invited 
Dr Peter Hutton to chair a group to encourage 
clinical buy-in and I believe that did very good work 
at the beginning. I met with the Academy of Royal 
Colleges a week ago to discuss establishing a joint 
group which I will co-chair to ensure that we do get 
buy-in at the senior level. Locally we need individual 
NHS trusts to do the same and I think that then 
comes to the issue of getting strong management 
support for IT and for implementation of the 
programme. David Nicholson, the newly appointed 
(some months ago now) Chief Executive of the NHS 
has made it absolutely clear that IT is to be one of 
the top priorities for the NHS over the next few 
years. We have now given a clear and explicit 
responsibility to Strategic Health Authorities in 
terms of their accountability for local 
implementation. In all the meetings that I have been 
involved in and David Nicholson has been involved 
in engagement with chief execs of the local NHS 
organisations, we have emphasised that this has to 
be one of the most important areas of responsibility 
that they are involved in. I think the big change that I 
have noticed in the four-year gap has been the much 
stronger buy-in by senior managers, both nationally 
and locally. We need to make sure that clinicians 
locally are also brought into the process. 


Q581 Chairman: When you look at the whole history 
of the National Health Service over the last 60 years 
and its culture as an institution, why was that not 
one of the things that was done in the early days? It 
seems to me that would be something that would be 
so obvious particularly when it was going to be a 
national programme? 

Lord Hunt of Kings Heath: | think that if you look 
back, one of the problems of IT historically is that 
many senior managers in the NHS did not give it the 
priority it deserved. That was one of the reasons why 
we went for a top-down national programme. I 
make no apologies for that because I come back to 
my earlier point, I do not believe that unless it had 
been driven and driven hard from the centre we 
would have made the progress that we have. We 
have moved into a new stage of the programme 
where it becomes ever more important that there is 
local ownership, and I think now is the time that we 
really do need to get the managerial buy-in. I am 
confident that we are now getting it. 

Mr Granger: The Programme was initially led by a 
doctor—Professor Sir John Patterson. The clinical 
aspects of the Programme were then led by another 
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doctor—Dr Adrian Halligan. We then set up a panel 
of national clinical leads including three doctors. 
The specification exercise involved hundreds of 
doctors whose names were in fact made available 
and the organisations they represented to the PAC 
last year, so it is not the case that there has not been 
clinical and medical leadership of the Programme. 
The challenge has been getting people locally 
interested in something which was in the future. 
They get most interested in it when it becomes 
disruptive when a product is about to be delivered; 
when training is required and when staff rosters need 
to be altered and so on. The challenge is getting them 
interested early enough. I think one of the pieces of 
evidence you received contains a complaint from a 
specific group of doctors that it is impractical to 
make seven days available over a two-month period 
for input to design. The continuous paradox that we 
face is getting people that are caring for patients 
involved early enough with the disruption that 
causes to their lists. I think it is difficult. 
Undoubtedly, at a small scale you can achieve that 
more readily with local installations. What you 
cannot then achieve is ubiquity of local installations 
because you only get installations in a limited 
number of sites, so the 105 community hospital and 
community PAS systems we have put in you do not 
hear a lot about. What you hear about are the 
difficulties we have in the acute sector getting that 
level of clinical engagement. You do not hear about 
10% of GP systems replaced. You do not hear about 
the dozens of sites every month where we roll out 
picture archiving systems. You only ever hear about 
the problems and those problems are most severe 
where the clinicians are most busy managing against 
their whole set of targetry. Getting those people 
involved early enough is going to be an on-going 
problem. 


Q582 Charlotte Atkins: When we visited Homerton 
Hospital last week I think what we were very 
impressed by was the clinical engagement, but that 
was clearly developed very much on an incremental 
basis because this has been developed over a number 
of years. I think the other thing was that clearly the 
trust had been contracting directly with the system 
supplier so there was much more of a management 
buy-in and also development of a system which 
would reflect local needs. How is that going to be 
replicated when you have the national programme 
because inevitably there is going to be one-size-fits- 
all kind of approach? 

Mr Granger: You saw two systems at the hospital 
Simon works at. You have also seen a PACS system. 


Q583 Charlotte Atkins: Yes. 

Mr Granger: So it is interesting that you can put a 
PACS system in on a standard product in every 
single site in London now and you have a PAS 
system which was bought locally, and the same 
would be true of University College Hospital, but 
both those contracts now in fact are run by BT. So 
you come back to this paradox of the necessity of 
strong local leadership and management ownership, 
which David Nicholson is addressing through the 


NLOP Programme of putting targets for this activity 
on to trust and Strategic Health Authority chief 
executives with a necessity of buying things at a 
higher level in the NHS in order to make them 
affordable. So we have to do both; it is not an either/ 
or. The Homerton has now transferred its contract 
to BT so that it can get some economies of scale and 
have the systems managed on a professional basis 
with the relevant levels of resilience and so on. This 
is also part of the problem of doing thing locally, as 
those trusts that endured the Buncefield Oil Depot 
fire and no IT systems for two weeks through a 
locally procured systems (with significant data loss) 
can probably testify to you. 

Dr Eccles: The big thing I hope you saw at the 
Homerton was that this was seen as a Clinical 
project. It was led by their clinical staff. It was chief 
executive level decision. This was not run by the 
finance director and the IT department as an IT 
project for cost savings. 


Q584 Dr Naysmith: This is what we are particularly 
worried about because Mr Granger was saying that 
the other two areas we were talking about—the 
Wirral and so on—were unaffordable and what 
worries me is this very issue that it is was not finance 
driven, that it was clinically driven, and therefore 
you have got a system that actually works with 
clinicians being involved on a hands-on basis with 
the system. I am worried that with a national 
programme you will get a one-size-fits-all which 
means therefore you will not get a clinical buy-in and 
you will also not get the hands-on approach which 
we saw at the Homerton. 

Lord Hunt of Kings Heath: Of course you probably 
will not get the systems because you hit then the 
unaffordability issue which we faced back at the start 
of the programme. Mr Granger has already referred 
to the Shires and the programme in the West 
Midlands where there was clinical engagement. | 
met many of the clinicians involved and they were 
very enthusiastic but you ended up with a situation 
where it simply was not affordable. There is no easy 
answer to this. There has clearly got to be a balance 
between the benefits of a national programme in 
terms of the value for money but also the strength of 
a national contracting process aligned with doing as 
much as possible to get local buy-in to it. There is 
bound to be a tension there. 


Q585 Dr Naysmith: There is bound to be a tension 
but are we learning the lessons from Homerton, not 
just in terms of the clinical buy-in at a hospital level 
but also clinical buy-in at the GP level, because what 
we saw there was that they could not work 
electronically with the GPs? 

Dr Eccles: With regard to the first of those, yes, I 
think we have been learning the lessons, as you 
rightly point out, from the Homerton both within 
London on its patch and indeed across the whole of 
the South where that particular Cerner product will 
be deployed. Myself and Michael Thick, the Chief 
Clinical Officer, have been round many of the live 
sites with Cerner having those discussions. What we 
have seen is where there have been elements of that 
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that have not gone as well as they could have done, 
that is usually because those lessons were not 
followed even though they had been very well- 
described. The second point I want to make relates 
to what you described as the one-size-fits-all. I do 
not want the impression that the product simply 
arrives in a box and that is exactly what it looks like 
and there you are. That is not how it works. There is 
a huge degree of local tailorability to it. What 
matters is that, underlying it, the architecture of how 
tests are ordered and patients’ details are moved 
around the hospital and the coding that applies to 
the disease process, are stored in a very clear, logical 
way and is then compatible with GP systems at the 
Spine and elsewhere. However, on top the layer that 
you look at can be tailored hospital-by-hospital and 
eventually group of clinicians by group of clinicians 
to the sort of view that they wish to have. That is true 
both of the Lorenzo product and of the Cerner 
Millennium product. 


Q586 Dr Naysmith: But each of the hospitals under 
the national system will be working through a local 
service provider rather than dealing with the systems 
people direct. Will that lead to a lack of buy-in and 
also a system which is not as well-tailored to their 
needs as we have seen with Homerton and other 
hospitals? Clearly we want a national programme 
which is cost-effective but there is no point it being 
cost-effective if it does not work properly. 

Mr Granger: | think we have some hard choices to 
make. I think you have been to see the Veterans’ 
Administration. Did you have a discussion with 
them about the degree of variability they allowed 
between sites? Because the answer was none. 


Q587 Dr Naysmith: Absolutely and what is more 
there is no option but to buy in. 

Mr Granger: But that has given them a system which 
has a lot of very useful clinical information at the 
point at which decisions are made. If we would like 
to indulge ourselves with 200 rich local systems 
across the NHS we not only cannot afford them, we 
will forever be locked into information not being 
moveable between locations. There has to be a 
balance struck between standardisation and 
localisation, and, unfortunately, some of the desire 
for local variability is simply not affordable. When 
we computerised Social Security in this country 
there were 600 or so local offices in the DSS many of 
them did things differently. There is now one 
national Social Security system in fact for the UK 
not just for England. It is quite interesting to imagine 
that we are going to allow every group of clinicians 
and every group of managers in every NHS trust to 
do everything as they so choose. 


Q588 Dr Naysmith: No, I do not think we are saying 
that at all. I think what we are actually saying is if 
this is going to work we have to have proper clinical 
buy-in and we all know, do we not, that doctors can 
be pretty difficult characters and doctors have a huge 
amount of power in the NHS, and if we are not going 
to get them buying in then it is not going to work 
properly. You mentioned the Veterans’ 


Administration. Yes, of course we saw the system 
but I do think the Veterans’ Administration is 
somewhat different to the National Health Service 
one because being ex Services they are more likely to 
be compliant around their records so I do not think 
there is a direct comparison there. What we are 
concerned about in the Committee, given that we are 
putting so much money into this national 
programme, is that it works. That means we have to 
have proper clinical buy-in and we cannot cut 
those corners. 

Dr Eccles: And we are hitting the tipping point that 
I think will make the critical difference. Lord Hunt 
and Richard Granger have made the point that it is 
extremely hard to get good clinical engagement with 
a piece of paper talking about an IT system. It is 
exceedingly hard. It is very hard for the NHS to 
release people. It is very hard to get people excited 
about it. What you tend to get is the people who are 
very interested in IT, which is fine, but the people I 
want to get engaged are the people who loath IT 
because if it works for them it will work for 
everybody else. As soon as you have begun to get the 
systems rolled out in the enthusiastic early hospitals, 
at that point everybody switches on that this is real, 
it is going it affect them, they can go and see it, they 
can see it at a neighbouring institution and at that 
point if that is going to come to my hospital I want 
to get involved in the committee that is designing it 
for my hospital and tailoring it and I want to be part 
of it. We have to get past the point of visibility to get 
the bulk of clinicians engaged. It has been my job for 
the last couple of years to try and get doctors 
engaged with an idea. They are very enthusiastic 
about the idea. They are not necessarily enthusiastic 
about giving up huge amounts of their time to fine- 
detail Excel spreadsheets to make it work. Now that 
they can see it, it is much, much easier to get people 
enthusiastically engaged, and they are enthusiastic. 
In secondary care we have overwhelming support 
for getting this in. People want it but they want it to 
work for them, and you are quite right on that. 


Q589 Dr Naysmith: With Dr Eccles involved I hope 
that we have some chance of making it work. 

Lord Hunt of Kings Heath: \f {can comment on that. 
Clearly one of our strengths is that we have a huge 
network of clinicians who are involved. I do not 
disagree at all with what you are saying about the 
need for local clinical engagement, I understand it 
fully. I just think that in terms of the history of the 
National Health Service that experience shows that 
the best way to do it is to start with a national 
programme, get the investment in, get the clinical 
engagement. I am convinced that we have got the 
architecture right. If you are saying we need to do 
more with clinicians, I agree with you. I do believe 
that the renewed drive, the priority, the targets that 
have been set for Strategic Health Authorities will 
absolutely require chief executives to do that. I also 
think that, as Dr Eccles has said, the more clinicians 
are using some aspects of the new system the more 
champions we have. Of course there is this question 
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of where do you reach the tipping point, where do 
you get the momentum that really does get that 
critical buy-in. 


Q590 Dr Stoate: As a practising doctor I know 
exactly how clinicians think. Clinicians are all in 
favour of progress; it is change they cannot stand! 
You might think that that is facetious but actually it 
is true. You will get buy-in to the point where it starts 
to disrupt the way they do things and that is when it 
starts to clash. Choose and Book is a great example. 
I think most GPs in principle are very happy with 
Choose and Book. If it interferes with the way they 
do their work and if it clunks along and causes them 
problems, they get angry with it. It is not the 
principle; it is the practice they have got problems 
with, and those are the issues we have to smooth out. 
What I wanted to talk about was this dichotomy 
between central and local buy-in, if you like. I 
understand the point you are making, Lord Hunt, 
about the fact that we have to with economies of 
scale use a central system to drive progress, that is 
fine, and we also know that clinicians like local 
systems. GP systems now have been decentralised to 
the point where GPs can choose their own supplier. 
How much further do you intend to go as part of this 
programme in decentralising as much as you 
possibly can? Do you have anything in mind that 
you are going to further decentralise? 

Mr Granger: One of the interesting things about the 
decentralised GP systems is the paradox of the 
excellent support that they give to you as a GP in the 
building in which you deliver care and how 
incredibly useless they are in all other contexts. So 
they are not very useful for you as a GP in the 
patient’s home; they are not very useful for you as a 
GP when you are doing a session for an out-of-hours 
service provider; they are not very useful for your 
patient when they are anywhere else; and they are 
not very useful for 3.3 million patients when they 
change GP a year. 


Q591 Dr Stoate: So why have you let GPs have 
different systems? 

Mr Granger: We have been trying to walk a difficult 
path between real inter-operability between 
competing suppliers who talk the talk about 
information exchange between their systems and 
then deliver systems which are fundamentally 
incompatible with the previous versions of their 
systems and with their competitors’ systems. 


Q592 Dr Stoate: I was going to ask you about that 
because you have put in this RFA compliance that 
they all have to meet the specifications, and 
presumably they all do, and yet the point is that none 
of them is compatible with each other and if you 
migrate from one GP system to another you lose 
unacceptably high levels of data. 

Mr Granger: | think we are coming to a point with a 
variety of key information around the issuing of 
prescriptions, around the making of bookings, 
around the verification of demographic data where 
we are using HL7 Version 3 standards which means 
that if the other countries in the UK want to step on 


to the arrangements we have they will be able to 
because these are international standards. They are 
not English standards, so that is dealing with a 
number of real-time information exchanges. We are 
also at a point now where the GP-to-GP record 
transfer programme, which along with RFA pre- 
dates the establishment of a national programme, we 
are getting to a point where we are getting good 
information transfer between competitor 
heterogeneous GP systems. We had some difficulties 
with the GP contract in 2003 and the national 
programme running in_ parallel and_ the 
interpretation of the words “choice of system”. We 
bought a choice of system but we did not buy the fact 
a GP could have any system they so chose. I think 
we are finally getting to the end of that problem by 
having a number of compliant systems, but it is no 
different to the hospital sector where the greater 
variability of systems and the cost of testing those 
systems militates against serving the interests of 
people who want information to move between GP 
practices. 


Q593 Dr Stoate: I am not disagreeing with you; the 
point is why have you allowed this to develop 
knowing, as you do, that you will cause yourself 
some more problems? 

Mr Granger: We are trying to strike a balance. We 
recognise that a lot of GPs do not want to change the 
system they have got because it supports them very 
well and is delivered by people who understand what 
they do. At the same time we want systems which 
support their patients in multiple locations. 


Q594 Dr Stoate: You have not got that, so how will 
you get that? 

Mr Granger: We are getting there with that. If you 
look at the work that TPP have been doing, for 
example, where we have now got 10% of GP 
practices properly hosted in professionally run data 
centres— 


Q595 Dr Stoate: Is that your vision then, to have 
hosted data for GPs? 
Mr Granger: Yes, and that is exactly what EMIS is 
also pushing towards. 


Q596 Dr Stoate: That is your vision for the future, is 
it, for GPs? 

Mr Granger: Yes. | do not think having servers sat 
in GP practices with a whole pile of maintenance 
problems, and difficulties accessing, information on 
them out of hours, serves the way people wish to be 
cared for. 


Q597 Dr Stoate: Are you confident that will actually 
work because the connectivity between GP practices 
and anything outside the building is not very reliable 
at the moment? 
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Mr Granger: Is it not? 


Q598 Dr Stoate: No. At the moment, for example, 
Choose and Book is, to say the least, slow. If I had 
to run my entire clinical system using some sort of 
broadband connection as they currently are, I would 
have real difficulties. 

Mr Granger: 10% of GPs in the country now do that 
and I do not hear them complaining about the speed 
of performance of their TPP applications or their 
network connection. If you take some of the legacy 
GP applications there are some problems with the 
way they have configured their system to operate 
Choose and Book. This is not a Choose and Book 
problem and not a network problem. It is a legacy 
application configuration problem. 


Q599 Dr Stoate: In summary, you want to go down 
the route of more uniformity eventually so that these 
systems have effectively less choice but more 
compatibility, is that what you are aiming for? 

Mr Granger: Yes. 

Lord Hunt of Kings Heath: What you have really 
described is the same discussion that we have had 
before, the trade-offs here. There have had to be 
some trade-offs with the GP community and you see 
some of the downsides of that, which is the 
variability. I think it very clearly illustrates the 
debates that we are seeing but in the end we have to 
have a system that really works together rather than 
the problems that you have described. 


Q600 Jim Dowd: By nature, I am slightly more 
optimistic than some of my colleagues. I want to 
look at the position when the system is in and 
working and obviously it must then become a 
permanent feature forever more beyond that. The 
contracts only have a ten year lifespan. What do you 
imagine will emerge after that? The system will 
obviously need upgrading, it will need improvement, 
it will need software new releases, et cetera, who is 
going to be responsible for that and how is that 
going to work? 

Mr Granger: | would say we will be in quite good 
shape because we have based the core national 
applications on the dominant global database 
supplier, Oracle. And we have based _ the 
applications on standards which are becoming 
dominant global standards. In terms of local 
provision we continue to have contestability so we 
should not have the problem of having to effectively 
bribe the market to compete because we will not 
have a monolithic national standard. With the 
central systems where we have got one supplier there 
have already been numerous upgrades and that is 
just business as usual. Because we are operating to 
international standards in terms of the messaging 
structures and applications and so on, we should 
well be able to run healthy competition there. 
Because of the adoption of these standards and, 
which was not without pain having had to set up an 
international body for data standards, for example, 
SNOMED CT, we will be in a position where the 
systems we are using will be similar to the systems 
being used in other jurisdictions. If you look at what 


is going on with the regional health organisations in 
the States, which are effectively pilot operations at 
the moment, they are going to step up to those 
standards when they start doing things on a more 
robust and industrial scale. 

Lord Hunt of Kings Heath: \ was just going to say 
what is really exciting is we are clearly going through 
the pain barrier at the moment, it certainly feels 
painful, but, as we know, the more clinicians engage, 
the more benefits they get and the more enthusiastic 
they become. By 2010 the health service will have 
made a significant advance and, of course, the 
momentum will be there and it will not want to stop 
there because people will increasingly see the 
benefits. I believe that alongside the national 
infrastructure that we clearly will need to develop 
and take decisions on in due course, we will also get 
the essential enthusiasm at local level in terms of 
using these systems. There is not much point in 
doing this unless we can see at the end of the day 
improved safety and quality for patients, and 
patients will increasingly see a really fantastic service 
as a result of all these changes. 

Dr Eccles: | would take a slightly different line from 
my two colleagues, which is we will have got used to 
it and in consequence we will be complaining about 
it bitterly, that it takes up to three seconds to get a 
CT scan from the neighbouring hospital and you 
have to sit there and wait for ages looking at the egg 
timer and how disgraceful is that. 


Q601 Jim Dowd: That is irony, is it? 

Dr Eccles: As broadband gets faster and faster you 
still keep complaining it is not quick enough and we 
are going to be where the patients will expect their 
records to be instantly available whenever they 
change GPs and if it takes two days they will be 
complaining about the two days rather than the 
three months it takes now. On Dr Stoate’s comment 
that we like progress but we do not like change, we 
are going to see the innovating hospitals, the 
innovating individual clinicians, taking the systems 
we have got and sprinting into the distance with 
them designing generation after generation ahead. 
And some of their colleagues will be sticking with 
exactly the core product they have been supplied 
with and will not change a thing for the next ten 
years after that. 


Q602 Jim Dowd: Is not the danger that that takes us 
back to exactly the position we are in now and trying 
to escape from? 

Dr Eccles: No, absolutely not. If I take a transport 
analogy that we are moving everyone to either 
Mondeos or Vectras, and we will get there in ten 
years’ time and everyone will have them, at the 
moment some have vintage Bentleys and an awful 
lot have rickshaws. We have got to get to a common 
level and that common level is actually world class. 
There is not another country that will be in the state 
we will be in at that stage, we will be ahead of the 
game and the NHS, I think, can genuinely be proud 
of the change in quality of care it can provide as a 
result. Moving forward from there is easy, that is a 
good thing. We have got everybody on to an 
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electronic environment using a common coding set 
across the whole of the NHS with free movement of 
patient data with permissions as appropriate. We 
can do research off that in a way that no-one else, 
except possibly Sweden, can at the moment. That is 
absolutely brilliant. If some people start innovating 
from there others will copy them. Yes, there will be 
one or two who will stay where they are at that point 
but that is a hell of a long way ahead from where they 
are now. 


Q603 Jim Dowd: It was put to us today that there is 
a philosophical divide here as much as anything else 
insofar as we should have just waited to see what 
worked elsewhere and utilised that rather than 
attempting to— 

Dr Eccles: Why would we want to be last? 


Q604 Jim Dowd: --- rather than attempting to create 
the international standard to which others will 
aspire. I accept there are probably irreconcilable 
differences and you will not be able to say which is 
right unless, of course, it does become world leader. 
Can | just test that fora moment from the taxpayer’s 
point of view. The experience so far has been a 
reduction in the number of suppliers and 
participants. You said earlier, Mr Granger, that it is 
possible—I will not say highly likely, one has to be 
very careful about this—that as Millennium works 
and Lorenzo does not we might wind up with simply 
Millennium everywhere as regards the hospital- 
based EPR systems. Is there not a danger that we will 
have a reducing number of participants, people able 
to supply and support the system and, therefore, the 
ability for the taxpayer to extract maximum value 
from any upgrades or changes in the future will 
diminish? 

Mr Granger: That is a risk. Of course, there are no 
prizes for the NHS not having already fallen into 
that trap. Nobody says, “Oh, it is quite good actually 
that you recognised that in January 2003 when you 
published a procurement strategy that you were not 
going to immediately become reliant on one supplier 
for everything”. Of course, the Department of 
Health in 2002 was full of large corporates walking 
up and down the corridors talking to people, 
imploring them to just turn the whole lot over to one 
supplier and, indeed, to TUPE out around 20,000 
frontline IT staff from NHS trusts to one supplier. 
We did not put our head in that particular noose. I 
do not think we will end up in a situation where we 
have the Millennium product across the whole 
country but we do have difficulty attracting the 
interest of competitor patient record suppliers. One 
of the other major suppliers has told us that because 
of the variability in the NHS they are just not willing 
to supply to us. It is a company called Epic who have 
some good systems but they say they are not willing 
to work with the NHS while there is this degree of 
self-determination amongst frontline clinical groups 
because their experience with Kaiser Permanente 
has been that you have to have a sufficiency of 
standardisation in order to be able to put the same 
software in across multiple institutions. Else you end 
up with incompatible datasets and an inability to 


move information to serve patients between primary 
and secondary care and, indeed, tertiary care. There 
is a danger there but ! think we have mitigated that 
as much as we can. 

Lord Hunt of Kings Heath: To put it bluntly, we are 
developing a world class system and we need world 
class suppliers to work with us. The situation ten 
years ago was that we were doing basically a cottage 
industry which would not have the capacity or, I 
suspect, financial strength to be able to support the 
NHS in the way that we wanted for the national 
programme. I also think that the contractual 
arrangements have allowed us to transfer risk to the 
local service providers and that is a big contrast to 
many other public sector procurements on IT where 
the client in the end has accepted the risk and then 
often had to pay considerably more amounts of 
money to make fixes to get the system right because 
they did not get the specification right in the first 
place. Clearly, I think the contractual arrangements 
that we have established put us in a much stronger 
position and we want to continue to do that. 


Q605 Chairman: Can I just ask you about the NPfIT 
Local Ownership Programme. You have given the 
responsibility for that to the SHAs to implement but 
the contracts are actually held by Connecting for 
Health. Is this not responsibility without power? 
Lord Hunt of Kings Heath: Mr Granger might want 
to talk about the details of the contracting process, 
but I do not think so. Obviously we expect the local 
service providers and other contractors to work 
closely with a Strategic Health Authority. They well 
understand that accountability has been transferred 
to the chief execs of the Strategic Health Authorities. 
David Nicholson and I have stressed to the NHS the 
importance of taking this seriously. If there are 
problems they will be dealt with. I think it has been 
a very good thing to have done to get that buy-in at 
the regional level. It will also ensure at the local level, 
with the chief executives of the trust, that there will 
be the absolute right, strong engagement that we 
need for the next phase of the programme. 

Mr Granger: Out in the NHS,in the SHAs in the 
north of England, the Midlands and the east of 
England, the six SHA ClOs—chief information 
officers for the Strategic Health Authorities—meet 
with CSC directly, with procurement contract 
experts and, indeed, technology experts present. 
They recently dealt with some contractual issues 
around the achievements and milestones on Lorenzo 
on a collaborative basis. The same thing has always 
gone on in London with a CIO for the Strategic 
Health Authority London—originally there were 
five SHAs, if I remember rightly, and now one. In the 
south the three SHAs recently appointed an 
individual with responsibility for managing the 
implementation of key systems there for Fujitsu and 
she, in fact, is leading the re-planning exercise for 
release one of the Cerner product with changes to the 
functionality that have been requested by frontline 
clinicians. We already have SHA personnel dealing 
day-to-day with key contractual management issues 
in collaboration with CFH people and frontline staff 
from trusts. 
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Q606 Dr Taylor: Can I go back for a few moments 
to clinical buy-in because it is marvellous to have 
enthusiastic national clinical leads, to have 
enthusiastic local champions and, Lord Hunt, you 
said huge networks of clinicians involved. We seem 
to have a knack of picking on the clinicians who do 
not feel involved. We have had one this morning 
from the Renal Association who feels distinctly 
uninvolved in that he has tried to get involved and 
failed. I would take exception really to Richard’s 
comment that critics want the system to fail; 
certainly the medical critics do not want it to fail. If 
I can quote one or two bits out of the Renal 
Association’s evidence: “We are therefore strongly 
supportive in principle of the development and 
establishment of electronic patient records” but then 
they give a litany of complaints: “Connecting for 
Health has failed to assure the renal community that 
its strategy respects clinical need as well as technical 
solutions; failed to develop an understanding of 
specific IT needs of ours and other specialist health 
communities; eschewed opportunities of early wins 
by demonstrating benefit in chronic disease 
management; and threatened the survival of 
specialist clinical software suppliers who understand 
well the needs of the healthcare community”. They 
are not alone, we have had other evidence from 
groups of clinicians who feel distinctly disengaged 
with the system. 

Lord Hunt of Kings Heath: \f | could make a general 
comment and ask Simon Eccles to comment on the 
details. Medical organisations are many and varied 
and they are not backward in coming forwards. 
Inevitably, in any major programme such as this you 
are never going to be able to satisfy every specialist 
group to the degree that they would think necessary. 
My role as minister back in 1999, 2003 and now is to 
make sure that the programmes we have established 
do allow for considerable clinical engagement and 
the submissions that are put forward are considered 
and then to make sure with David Nicholson that 
people out in the service understand the importance 
of clinical gains at local level. I am not going to say 
that this is perfect, nor indeed do I think it would 
ever be possible to meet all the needs that every 
specialist body produces, but I do think that what 
has been achieved, starting with the work going back 
to the start of the programme and more recently with 
the clinical champions and discussions with various 
bodies, is a very good foundation. I want to improve 
on that and that is why I have agreed to establish a 
high level group with the Academy of Medical Royal 
Colleges, which I will co-chair, to make sure if there 
are concerns they are heard by me and we make sure 
that we do engage as much as possible. Perhaps I 
could ask Simon Eccles to talk about the specifics 
of how— 


Q607 Dr Taylor: You have actually answered that 
and I want to move on to Detailed Care Records. 
Surely the real priority for improving patient care is 
to have the Detailed Care Record readily available 
at local level. We have been looking at security and 
somebody this morning repeated that security is 
really only a problem because of the widespread 


nature of the Summary Care Record. Why have we 
focused so much on the Summary Care Record, 
which from our demonstration at Richmond House 
a week or so ago looked to be merging much more 
into a Detailed Care Record? Why do we not keep 
the Summary Care Record as a single field with the 
demographic, the allergies and the crucial things, 
and then really work to develop the Detailed Care 
Record which nobody yet has been able to tell us 
exactly what it will be? That is what I want to know, . 
what exactly will the Detailed Care Record be? Are 
you actually working pretty hard to get that 
available because this is what will improve patient 
care? 

Dr Eccles: Yes, it will. They both will. The Summary 
Care Record is a subset of the Detailed Care Record. 
It is not one or the other. All the information in the 
Summary Care Record will have come from, and be 
contained in, the Detailed Care Record. 


Q608 Dr Taylor: Are you saying the Summary Care 
Record, by definition, has to come first? 

Dr Eccles: No, no, they could come in either order. 
They do not hinder each other’s development. The 
Detailed Care Records for an individual patient are 
currently held electronically in over 70% of GP 
practices and on paper in each of the hospitals in 
which they have been seen. If they have been seen in 
the emergency department they will have a separate 
record, in maternity they will have a separate record, 
paediatrics has a parent-held record in addition to 
their own records, sexual health will have their own 
record and mental health will probably have their 
own record. Those comprise your and my current 
Detailed Care Records and, as you will be familiar 
with, as I am, they do not always appear in front of 
the clinician who wishes to see them at the time at 
which they wish to see them. It is those records we 
are replacing with Cerner Millennium, iSoft 
Lorenzo and the GP systems of choice. In addition, 
in London they are using a separate community 
system and those are being done slightly differently 
in different areas depending on the needs they are 
getting from those. We need to ensure they all 
integrate with each other, that the information 
contained and entered into a detailed record once 
can be used many times in other areas for the care of 
that patient and can cross those boundaries from 
primary care to community care to hospital care. 
When relevant an extract goes to the Summary, so 
if you have only got one bit you have got the most 
relevant stuff. 


Q609 Dr Taylor: Who are you talking to about the 
design, particularly when one is thinking of common 
clinical standards so they have got to be all the same 
and easy to understand? Who are you actually 
talking to about the design? 

Dr Eccles: Lots of clinicians. 
clinicians. 


I mean lots of 


Q610 Dr Taylor: Specifically, are you talking to the 
Royal Colleges? 
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Dr Eccles: Yes. You have taken the lid off that can. 
Yes, indeed, we are. My colleague, lan Scott and I, 
as the national clinical leads for hospital practice, 
and Gillian Braunold and Mike Pringle for general 
practice, have met with all the Royal College 
presidents, we have met with most of the specialist 
association presidents and we have a_ national 
advisory group to which every specialist association 
is invited to send members. They do not always come 
but they are certainly invited. For example, the 
Choose and Book specialist reference panel has 
representation from just about all the specialist 
associations. We have certainly consulted at a 
national level as far as we conceivably can. I chair a 
clinical reference panel representing all of the 
different types of health professional as well as large 
numbers of patients. There are 26 people on there, to 
make sure we are not just dominated by the medical 
professional, for example, learned though we are, we 
have got to make sure this works for allied health 
professionals, for nursing staff. 

Lord Hunt of Kings Heath: That is why I am going 
to form this group with the Academy to make sure 
at that senior level they are content with the degree 
of involvement and buy-in. As you have heard, there 
is a huge network of discussions that are going on at 
the moment. 

Dr Eccles: We are doing that equally down at local 
level for the design and tailoring of the product. 
There are two big products for UK use. They have 
got large numbers of clinicians, over 2,000 clinicians, 
involved in the design, the build, the test and so on 
of those products at that level. You mentioned 
specialist systems, renal systems for example, and 
the Chief Clinical Officer, Professor Michael Thick, 
was due to meet the Renal Association pre-dating 
this panel. But in some large hospitals in the South 
of England, for example, there are over 70 databases 
held by specialist clinicians, in some cases several 
databases held within one specialty, because 
individual consultants cannot agree on the right 
database to use so they are using their own. At some 
point we are going to have to agree best of breed here 
in conjunction with those specialist associations, 
what we should feed to the manufacturers of that 
system: “Here is how to make sure it is compatible 
with ours so that data will flow out of the national 
system into your database”. What I hope is that our 
system will be sufficient to manage the day-to-day 
running of patients with renal disease to a high 
standard. It may not collect every data field that 
renal clinicians want because they have got some 
pretty detailed stuff that is not relevant to others, but 
we let them know how to get that information out of 
our system. By doing those two aspects I think we 
will fit the needs for specialist systems. 


Q611 Dr Taylor: So are there enough people like you 
who are going to engage with all of these specialists, 
the Royal Colleges? 

Dr Eccles: That is a very unfair question to ask me! 
Some would argue I am unique and I would have 
to disagree. 


Q612 Dr Taylor: Sorry, let us tie it down. How many 
people are there, and I do not mean just like you but 
equivalent, who are trying to engage with the 
specialist associations and the Royal Colleges? 
Lord Hunt of Kings Heath: We have got about 250 
clinicians who are working with us. 


Q613 Dr Taylor: Okay, fine. I will move on. 

Lord Hunt of Kings Heath: What I would love to see 
is more local champions of the programme, that is 
where it is clear from our discussions we want to see 
more emphasis given in the future. 

Dr Eccles: We need to divide the question into, not 
“You have not spoken to me about the design of the 
system”, but “Have you spoken to people like me 
about the design of the system?” We may not have 
spoken to each individual renal consultant but have 
we spoken to a sufficient body of opinion to get it 
right? 


Q614 Mr Campbell: Do the organisations know the 
names of these people? Are they given the names of 
these people, the organisations and the health 
authorities and trusts? 

Lord Hunt of Kings Heath: | am not aware that this 
is anonymous information, it ought not to be. I will 
certainly check up because clearly they ought to 
know. 

Mr Campbell: They might not know, that is the 
problem. 


Q615 Dr Taylor: We saw very clearly at the 
Homerton the enormous importance of the 
enthusiastic senior clinician right at the top. What 
are you doing via, I do not know, Strategic Health 
Authorities, whoever, to try to make sure that there 
is one such figure in every major hospital who will 
take it under their wing and convert everybody to it? 
Dr Eccles: This is part of the Local Ownership 
Programme. It cannot be for us centrally to go and 
start pointing a finger saying, “You are going to be 
the champion for this hospital” or, indeed, “Send the 
name of your champion and we will send them files 
of information”. Individual Strategic Health 
Authorities need to speak to the acute trusts in their 
patch to identify their champions locally. They must 
be locally derived champions, if you see what I 
mean. What we have found is this varies. We have 
done huge amounts of work centrally to try and 
encourage leadership. We have a_ leadership 
programme being organised by Connecting for 
Health, we are working with the British Association 
of Medical Managers to develop leadership here 
specifically around the Programme and we are 
talking to trusts. When one discovers a trust which, 
having put in their Patient Administration System, 
we ask them, “What was your clinical engagement 
strategy” and the answer is, “We chose not to tell the 
doctors”, I despair of that. 

Lord Hunt of Kings Heath: There are clearly lessons 
that are being learnt all the time, particularly with 
the introduction of Patient Administration Systems 
in hospitals. One of my aims is to ensure that we 
learn the lessons both good and bad and that is then 
translated into the roll-out of the programmes. 
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More generally, if you look at where the health 
service is going, the introduction of much greater 
patient choice, given that effective IT programmes 
assist patient choice and the perception of patients as 
to the value or success of a particular institution, it 
has got to make sense for senior management to 
engage the clinicians because if you have an 
institution where the clinicians have not been 
involved the one thing you can be sure is that when 
the Patient Administration System is introduced it is 
not going to work very well. Part of the reason for 
placing responsibility fairly and squarely on the 
National Health Service is to get that kind of 
commitment from senior management and it really 
is a no-brainer that within an NHS trust you want to 
have a senior respected clinician who is champion of 
the programme. 


Q616 Dr Taylor: What do you say to the critics who 
say because delivery of the Detailed Care Record is 
so slow it leads to loss of interest and then loss of 
engagement? 

Dr Eccles: | go back to the answer I gave to 
Charlotte Atkins earlier. While the product is 
invisible and coming at some point in the future it is 
relatively hard to get people enthusiastic. As soon as 
it is in the neighbouring trust it is much, much easier. 
Taking a slightly different topic of PFI hospitals, 
trying to get clinicians involved in the design of a 
new hospital build, whether it is PFI or anything 
else, is really, really hard but as soon as the 
foundations start going in the clinicians all flood in 
saying, “Well, how is it going to work then?” and it 
is too late by that stage. What we are hoping is that 
by having some trusts ahead early and by having 
worked so hard to get clinicians involved in the 
design up until now, when it is visible we will have no 
difficulty in its development which we have got 
carrying on for the next five or six years. 


Q617 Dr Taylor: Are you going to insist on more use 
of the NHS number? Will that go on the Summary 
Care Record? 

Dr Eccles: Yes. 


Q618 Dr Taylor: is that going to be widely used and 
unique so it can cross boundaries? We have heard 
there are problems with crossing to Scotland and 
crossing to Wales at the moment with the NHS 
number. 

Lord Hunt of Kings Heath: If I can make a general 
point, having the NHS number as the unique 
identifier is critically important. It is going to be one 
of the unseen but huge advances that we are going to 
make. That is not just in terms of administration but 
also in terms of patient safety. 


Q619 Dr Taylor: Is that included in the demographic 
bit of the Summary Care Record? 
Lord Hunt of Kings Heath: 
understanding, yes. 

Dr Eccles: Absolutely, yes. 

Lord Hunt of Kings Heath: On the Scotland and 
Wales issue, would you care to comment on where 
we have got to? 


That is my 


Mr Granger: It is currently an issue for devolved 
administrations as to what indexing arrangements 
they choose to have. We now have, and have in fact 
had since mid-2004, an online database with 
demographic details for the NHS in England. That 
is already accessible to about 7,000 locations. It has 
been accessed 319 million times since it went live and 
about 50,000 frontline NHS workers use it every 
day. The issue is not about having a highly robust 
online database which, unfortunately, had to replace 
a batch system that was rather quaintly implemented 
in the late 1990s by somebody who submitted 
evidence to you in defence of antiques, I think. That 
is not the issue. The issue is getting the plethora of 
departmental systems to support that indexing 
arrangement and, indeed, the GP _ systems 
reconciling different demographic information that 
is held locally and nationally. The GPs who use the 
electronic prescription service or Choose and Book 
experience that requirement today. We want to 
know that we have got up-to-date demographic 
information. We will have to migrate to a properly 
reconciled unique identifier, it is not something we 
can do on a big bang basis. Because our 
demographic information is passing around the 
NHS in England already on HL7 message standards 
it is relatively straightforward for other countries in 
the UK, or elsewhere, who adopt those international 
standards to exchange demographic information 
with us with the appropriate protocols. The 
challenge is their adoption of the standards rather 
than our systems. 


Q620 Dr Taylor: Will that number be different from 
the current NHS number? 
Mr Granger: No. 


Q621 Dr Taylor: How close are we to rolling out 
electronic prescribing, which seems to me to be the 
single most important thing to improve safety? 

Mr Granger: We are already rolling it out and as of 
last Friday 4,824, ie 56%, of GP practices and 4,397 
community pharmacies, ie 42%— 


Q622 Dr Taylor: It is hospitals I am really aiming at. 
Mr Granger: Okay. 


Q623 Dr Taylor: We know GPs are doing a lot of it. 
Mr Granger: In terms of e-prescribing systems in 
secondary care, that is going to come in over the next 
two to three years. The software already exists in the 
Cerner application. The initial implementation of 
Cerner has not put e-prescribing in although the 
software is built and works in hundreds of hospitals. 


Q624 Dr Taylor: Are any hospitals doing it already? 
Mr Granger: Yes, with local systems. 


Q625 Dr Taylor: With their own systems? 
Mr Granger: Yes 


Q626 Dr Taylor: Will they have to pull those out to 
put the new in or will they be able to keep those? 
Mr Granger: No. The Winchester system is planning 
to interact with the Cerner system. 
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Q627 Dr Taylor: Is it just a handful that is doing it 
now? 

Mr Granger: Yes. 

Dr Eccles: Part of the reason for going slightly 
slowly with this was we had huge clinical 
engagement on e-prescribing, and quite rightly, 
because it has got to be standardised. It is really an 
area where we cannot have local variability. We have 
absolutely clear critical safety. I do not know if you 
are aware—I was not until I started doing this 
programme—just how differently pharmacists, 
general practitioners and hospital-based doctors 
look at the same prescription for the same 
medication to the same patient. We have very 
different ways of describing the same thing. We can 
all have our unique view but we have got to make 
absolutely certain that we end up with the same 
product being taken by the same person with the 
same expectations on the part of all of those different 
professionals. 


Q628 Dr Taylor: I am fearfully disappointed really 
because I was involved in trying to implement it 
about 12 years ago and it was at that time that we did 
hit on exactly what you have said, the different 
perspectives from the pharmacists and_ the 
prescribers. 

Dr Eccles: We will have it sorted. 

Lord Hunt of Kings Heath: If one thinks “What is 
this all about”, number one it has got to be about 
improved patient safety: here is the clear, real 
winning goal that we must go for. 


Q629 Mr Campbell: Just on that point of safety of 
patients and dependability of the system, we have 
been told that when clinical records are remotely 
hosted, the loss of the hosting centre or the network 
for more than a few minutes could lead to loss of life. 
So both the hosting and the network need to be 
available virtually all of the time. Is there any 
evidence of this? 

Mr Granger: Yes, there is lots of evidence of it. 
Unfortunately, there are some members of the 
commentariat who seem to have trouble finding 
their way to the service availability data that we 
publish on our website. You may have received 
evidence from people who do not like looking at 
published service availability data. I think you had 
Patrick O’Connell from BT come and give evidence. 
BT run both the network and the core national 
messaging systems and there is a very strong body of 
evidence from the published service availability data 
for both those pieces of national infrastructure that 
not only do they work but they have the level of 
reliability and dependability which is appropriate to 
the task. We have not had any major network 
outages since we replaced the old NHS network. The 
last time there was a significant network problem 
was when the Royal Victoria Hospital suffered two 
routers failing as a consequence of them being 
plugged into a dirty supply rather than a clean 
supply during a generator test about two months 
ago. The last time there were any service problems 
and there were some performance delays, it was 
taking more seconds than was appropriate to get 


messages transferred on the Spine infrastructure in 
January last year, the last time there was a major 
upgrade, which in fact increased the level of 
reliability and number of back-up platforms that we 
used. There is some scaremongering about this 
which ignores the published data. I think we have 
been singled out for special treatment here because 
people do not compare what we have implemented 
in the NHS with anything else. They just have some 
abstract “It can’t be good enough” set of comments. 
I would like them to look at the reliability of our core 
systems and network against other pieces of civil 
infrastructure. If they have got some evidence that it 
is wanting on that basis rather than just 
scaremongering then I would be very happy to go 
back and review the contracted levels, which the 
suppliers do meet. 


Q630 Mr Campbell: Can I just read this out to you: 
“...a power failure at the CSC centre last year. 80 
Trusts (72 PCTs and 8 hospitals) lost access to 
records systems when servers failed and back-up 
systems could not be made to work”. That is the 
evidence we have been given. Was that just a one-off 
or could this happen all the time? 

Mr Granger: That is one part of the country, one set 
of systems. Three levels of back-up failed, no data 
was lost and the back-up systems that the trusts had 
in place meant that care was not disrupted. This 
scaremongering that this could have a serious 
clinical safety issue is completely wrong. 


Q631 Mr Campbell: So nobody could lose their life 
here? 
Mr Granger: No, not in that situation. 


Q632 Mr Campbell: In what situation would they 
lose their life if it failed? 

Mr Granger: | cannot envisage that situation. I do 
not know if you have received advice from 
somebody on some strange interaction between a 
locally run anaesthesia machine, for example, and a 
Patient Administration System, but that is a bit of a 
fantasy because it does not exist, or an intensive care 
system interfacing to a PAS system. The critical 
systems for patient safety that are run off generator 
backed-up power supplies in hospitals are a different 
kettle of fish from systems that contain information 
that is used for administration and care of people 
generally not on a real-time basis where frontline 
doctors have work-arounds and can revert to paper 
and undertake activities that do not necessitate these 
host systems. 


Q633 Mr Campbell: So the view that somebody’s life 
is in danger is scaremongering? 
Mr Granger: Yes. 


Q634 Mr Campbell: | would accept that. 

Dr Eccles: Absolutely. People’s lives are in danger 
by lack of information. If we do not know that their 
potassium is high then we do not know to bring it 
down and their life is in danger, that is absolutely 
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clear. That is far more prevalent right now than it is 
in the hospitals that have the systems that we are 
putting in place. 

Lord Hunt of Kings Heath: \f you look at the 
National Audit Office report or the National 
Reporting and Learning System run by the NPSA, 
they continually show issues due to medication 
errors and misidentification of patients. There is no 
doubt in my mind that the outcome of the National 
Programme for IT will be to have an appreciable 
reduction in those incidents. Overall I have no doubt 
whatsoever that this is going to lead to enhanced 
patient safety. 


Q635 Mr Campbell: I just want to nail it and make 
people aware that they are not going to die. We all 
know about computer failures, at least MPs do: the 
Child Support Agency, Child Tax Credits, “Sorry, 
the system has gone down”, and in that case it might 
be somebody getting mixed up with their money but 
in your case somebody might die and we need to nail 
this is not going to be the case before people start to 
back off from all of this. 

Mr Granger: If I can just add a couple of things. The 
failure that CSC suffered last year led to them being 
punished to the tune of £3 million. The allocation of 
that penalty around the NHS in the areas of the 
country that were affected by that was determined by 
the Strategic Health Authority CIOs, so that is part 
of this Local Ownership Process working. Since then 
CSC has doubled the amount of resilience that they 
have, so they are now running off four data centres 
rather than two. The specific difficulty that 
happened was because there were some engineers in 
Japan altering some microcode on a_ back-up 
platform but they have now ensured that specific 
failure cannot happen again. The probability of that 
happening is lower. The thing that is important is 
recognising the vulnerability—these are civil 
systems that have been bought on a budget and there 
can be failures with them. The back-up 
arrangements that the NHS have locally to deal with 
this type of failure, people keeping paper copies of 
things, keeping local electronic copies and having 
clinical procedures, mean they are not real-time 
dependent on this information. I will just point out 
to you that it is estimated by my colleague, Professor 
Michael Thick, our Chief Clinical Officer, that 40% 
of patients arrive for outpatients’ appointments 
without their records being present using a paper 
approach. We have got vulnerabilities with 
computer systems and their reliability, which are the 
bane of my life, and we have problems with paper as 
well. The same is true, for example, of picture 
archiving systems. Lord Hunt and I visited 
Basingstoke before Easter and the trust there 
estimated 20,000-30,000 studies had been re-shot in 
the year before they put their digital system in. That 
was 20,000-30,000 sets of radiation and costs applied 
to patients unnecessarily because the information 
was not available. There are problems with the 
analogue world as there are with the digital world. 


Q636 Chairman: Do you have a comparator in terms 
of databases in the UK? I know there are different 
levels of resilience that evolve but what is the 
comparator with the one you are implementing for 
the national patient record? 

Mr Granger: We asked CIOs and frontline clinicians 
in the NHS during the specification process what 
levels of resilience did they want. They had some 
degree of tolerance for planned downtime, and I can 
let you have a note on the details of this, and a low 
degree of tolerance for unplanned downtime. The 
computer vendors, frankly, had trouble getting their 
head around what the NHS wanted because the 
systems that had been put in nationally in the NHS 
previously defaulted to not being available when it 
was dark and all maintenance being done at the 
weekends. As soon as you started to introduce 
systems which people have a use for in an A&E 
department the vendors had to get their heads 
around the fact that they could not do their upgrade 
work on a Saturday night because we would quite 
like the system to be available then. Undoubtedly, if 
money were no object we would have bought 
another level of resilience and even lower levels of 
non-availability. I will let you have a note on the 
performance over the last year of all the key systems 
that we run and that is the information which is, 
indeed, on our website.! 


Q637 Chairman: The last issue is about patient 
privacy. We had some evidence given to us that the 
Summary Care Record and possibly the Secondary 
Uses Services could be challenged, or are likely to be 
challenged by European law. Do you think that is a 
serious risk? 

Lord Hunt of Kings Heath: | certainly hope not. We 
have taken advice from the _ Information 
Commissioner and from our own lawyers and we are 
confident that what we are doing is within the law. 


Q638 Chairman: Your lawyers believe that, there is 
no gap between what laws we have here in the EU 
and Europe? 

Lord Hunt of Kings Heath: Obviously part of their 
review has been looking at European law as well as 
domestic law. I am very happy to write a note to you 
about these aspects if you would like me to.? The 
bottom line is the advice that we have received and 
the advice from the Information Commissioner is 
that we are acting within the law. 


Q639 Chairman: I would be grateful for that note. 
Some critical parts of the NHS, clinical IT, are going 
to start keeping things as images and test results and 
they are going to be centralised. Of course, 
individuals can have the right not to have their tests 
centralised but in any way as you see it now, or in the 
future, are you likely to turn round and say to these 
individuals who have not had their tests centralised 
that the National Health Service cannot treat them 
because they are not on this system, the non-consent 
would then say that we cannot do that? 
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Mr Granger: In particular, section i0 of the Data 
Protection Act and an individual’s right, due to the 
level of distress they experience, to not have 
information processed is rather difficult in an 
environment in which we want to have a health 
service that is safe and efficient and, therefore, 
necessarily processes a number of pieces of 
information electronically. Pathology results and 
picture archiving are probably the two test cases and 
friction points around this. If an individual is so 
distressed that they do not want an x-ray to be 
conducted electronically, I think ministers would 
need to decide whether it was indeed in the public 
interest to maintain wet film processing, a 19th 
century technology, for these distressed individuals. 
Lord Hunt of Kings Heath: Clearly we continue to 
engage in these kinds of discussions but I think there 
has to be some reality here and the reality is that we 
are moving much more into a non-paper based 


Q640 Chairman: I think that most GP practices now 
have got records held electronically, have you any 
evidence that people can opt out of the electronic 
local record in their GP’s surgery and they can tell 
them they want theirs to be paper based? 

Mr Granger: It would be impossible for somebody to 
be registered with a GP in the NHS without there 
being an electronic record because we would not be 
able to pay the GP. Whilst I am sure there are a 
significant number of philanthropic GPs, there has 
been very, very good take-up with our payments 
system under the new GP contract. 


Q641 Chairman: In as much as the Detailed Care 
Record is held in a GP’s surgery there is no opt-out 
there under any circumstances, would that be a fair 
analysis? 

Mr Granger: Yes. 

Lord Hunt of Kings Heath: Of course there is a 


requirement on clinicians to keep records and that is 
in the public and patient interest. 

Chairman: Could I thank you all very much indeed 
for helping us with today’s evidence session. 


system. 


Supplementary evidence submitted by the Department of Health (EPROIA) 


1. The Health Select Committee is conducting an enquiry into the NHS electronic patient record, which 
is the cornerstone of the NHS National Programme for IT (the Programme). The Committee has taken or 
received evidence from the Department of Health (the Department) and a wide range of other witnesses. 


2. The Department submitted written evidence in March 2007. Departmental officials also gave oral 
evidence on 26 April 2007 and are due to return, with the Departmental Minister, on Thursday 14 June 2007. 
In advance of this next session, this note provides additional Departmental evidence relating to some of the 
issues raised during the Committee’s enquiry. 


TERMINOLOGY RELATING TO ELECTRONIC PATIENT RECORDS, DETAILED CARE RECORDS AND SUMMARY CARE 
RECORDS 


3. In particular, this note aims to provide greater clarity on the differences between Electronic Patient 
Records, Detailed Care Records and Summary Care Records. The terminology often used includes 
references to: 


(1) Electronic Patient Records (EPR): EPR is a catch-all term covering the patient data held in digital 
form by computers. The Programme is delivering a number of EPRs. A Summary Care Record 
(SCR), Detailed Care Record (DCR), Diagnostic Test Order and Results, PACS images and all other 
clinical data held in computers are examples of EPRs. 


Detailed Care Records (DCR): At present patients have many Detailed Care Records. These include a 
GP record, usually held electronically but often supplemented by paper records. Where patients have 
visited a hospital or clinic, there will usually be an electronic patient administration record; a separate 
written clinical record in their local hospital; a separate paper record if they have been pregnant; a 
further separate paper record if they have received mental health treatment; another separate paper 
record if they have been treated in the sexual health clinic; and a separate record if they have attended 
Accident and Emergency (A&E). Each of these records will be repeated for each hospital or clinic the 
patient has attended. In addition the patient may have a community record if receiving long term care 
in the community (eg, physiotherapy or care of leg ulcers). 


The Programme has a clear objective to reduce this duplication of diverse records by providing a 
patient centred electronic Detailed Care Record that spans these areas. As a minimum, this would be 
within a hospital but there are real benefits when providing a consistent record across a local health 
community and across the boundaries involved in care pathways for a patient. 

The overall objective is a single detailed care record for an individual patient that is accessible by the 
GP and by community and hospital care settings. Local Service Providers (LSPs) have chosen to 
deliver this vision by integrating systems, eg, in London the GP system InPractice will be integrated 
with the Cerner hospital system and Rio Community system. Initiatives such as GP Systems of Choice 
support this level of integration. 
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(3) Summary Care Records (SCR): A subset of the detailed care record held by GPs and Secondary Care 
will be made available nationally and this is the Summary Care Record. By late 2008 it will be capable 
of holding a patient’s current medications, allergies, significant past events from the GP detailed 
record and all discharge letters from hospitals from A&E, Outpatients and Inpatient visits. The 
precise content of the SCR will be determined by a clinical reference panel representing the views of 
clinicians. 


THE REASONS FOR HAVING BoTH SUMMARY CARE RECORDS AND LOCAL DETAILED CARE RECORDS AND THE 
DIFFERENCES BETWEEN THEM 


4. The NHS Care Record Service (NHS CRS) aims to establish an electronic health record for every 
person in England by 2010 to support the NHS in delivering better, safer care. The NHS CRS comprises 
two distinct yet integrated elements: 


(1) Detailed Care Records—created and managed locally by different providers of NHS services 
including the GP, Acute Hospital or Community Hospital; 


(2) Summary Care Records—held nationally on a centrally managed database (the Spine) and populated 
by contributions from the Detailed Care Record. 


5. The two records fulfil different objectives: 


(1) The Detailed Care Record will contain the full clinical notes for each patient, recording each care 
event. This reflects the current arrangements but, in future, records can be shared amongst a locally 
determined health community that is on the same IT system. Typically, as a minimum, this is at GP 
practice level or hospital level but can span Strategic Health Authorities (SHAs) or other local health 
communities as agreed between the NHS and suppliers. The Detailed Care Record aims to be patient 
centred and the specification includes functionality to support clinicians in delivering safer and better 
patient care, for example to support electronic prescribing, to provide decision and knowledge 
support and to provide access to digital images stored on PACS systems. 


(2) The Summary Care Record will contain those elements that are important in supporting care in 
unscheduled events and/or the transfer of care between providers. It will contain details of 
medications, allergies, adverse reactions and significant aspects of a person’s care. The patient’s 
Summary Care Record will be available (subject to the appropriate security controls) to any clinician 
who has a legitimate relationship with a patient from any healthcare location in England connected 
to the secure NHS Network. 


6. The introduction of the Summary Care Record is essential because: 


(1) Even after full implementation of the National Programme there will always be providers of NHS 
care who do not have locally integrated systems, for example out of hours service providers, private 
sector providers of NHS care or hospices etc. In these cases, the Summary Care Record will provide 
an invaluable tool in ensuring that joined up patient care is as extensive as possible. Provided that 
healthcare professionals are on the secure N3 network, have a smartcard and a legitimate relationship 
with the patient they will be able to access the Summary Care Record. 


(2) The Summary Care Record will facilitate joined up care at a local level in advance of local detailed 
records becoming integrated. The Summary Care Record is being implemented currently across a 
number of early-adopter sites, with national rollout following from 2008 after the evaluation of 
experience in the early-adopters. 


7. The Summary Care Record will also provide additional benefit for patients who wish to play an active 
role in managing their own care and treatment as it will enable them to have access to their own Summary 
Care Record—either through HealthSpace or by requesting printouts of their record. This is a new service, 
enabling them to become partners in their own care and helping to ensure transparency and accuracy of 
records through empowering patients. 


STRUCTURE AND CODING IN RECORDS SUPPLEMENTED BY FREE TEXT AND DOCUMENTS 


8. Some existin g, legacy EPR systems duplicate the paper-based document style approach to note taking. 
These act as a passive repository of documents but the underlying electronic system does little more than 
pull together all the documents relating to one patient. 


9. The Programme has adopted a much more structured approach which organises and codes the data 
entered into the EPR. This approach ensures individual items of data (such as diagnoses) can be entered 
once but then used many times throughout the record. This is fundamentally more difficult but provides 
significant benefits in terms of: 


(1) improved patient safety by ensuring consistency of information and alerts when eg. a diagnosis does 
not fit with a prescription; 


(2) significant time savings for clinicians and their patients, as significant amounts of information will not 
need to be recorded again and again (as now); 
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(3) improved access to information to report, assess and improve community health; 
(4) allowing decision support systems to operate effectively by applying rules. 


10. To deliver these benefits clinicians will need to adopt the new approach to record keeping. This will 
need a cultural change in the practices of health professionals which should not and could not be led by an 


IT programme but must be seen as a significant improvement to patient care and therefore owned and led 
by the NHS. 


11. Free text can be an important part of clinical recording where it is used appropriately. Conversely, 
coding of care events ensures they are recorded unambiguously and allows improved decision support and 
safer transfer of care. This is a question of balance, but the right balance is not struck currently as people 
use free-text because it can be easier for them than codification. However, unless they are the only person 
caring for the patient, it leads to systemic inefficiency across the NHS and raises issues of patient safety. 


12. An Information Standards Board, which operates independently, authorises the use of coding and 
terminology within the Programme. It does so only after rigorous peer review and safety assessments. 


13. There is no intention to remove free-text from patient records which, used correctly, is vital to enrich 
the record. To ensure clinicians have the maximum choice to support their individual ways of working, the 
Programme is promoting diversity of input, for example keyboard, speech and handwriting recognition 
when these are shown to be reliable. 


14. In answering a question from the Committee on the computerisation of hospital notes, Dr. Gillian 
Braunold said: 
“_.. we would change the way we work; that we would only need to send each other actions, 
instead of sending each other information that we share on a Detailed Care Record. That for me 
is the Holy Grail of what we are about. It is really about changing the effectiveness and the 
efficiency of how we work.” 


RECORDING AND SHARING OF PATIENT INFORMATION 


15. There are three key issues relating to patient confidentiality and the introduction of the Summary and 
Detailed Care Records: 


(1) should patients be required to have a Summary Care Record and/or Detailed Care Record; 

(2) should information on the Records be shared and; 

(3) how should any choice be exercised, explicitly (by opt-in) or implicitly (by opt-out)? 

16. Both the law and professional regulation require adequate records to be kept and the law provides 


only one legal route for patients to object—Section 10 of the Data Protection Act 1998 in cases where the 
patient can show that substantial distress or damage would be caused. 


17. Patients do not therefore have an automatic legal right to choose whether to have medical records. 
The complexity of modern healthcare and the reliance of clinicians on electronic systems means that, though 
this is a matter of local clinical judgement, there will be little opportunity for patients to request that 
information is not entered into Detailed Care Records—this is no different from now. However as a matter 
of policy, the Department’s Ministers have determined that patients should have a choice in respect of the 
creation of Summary Care Records. 


18. There has been much debate on the relative merits of the opt-in and opt-out approaches in relation 
to the creation of Summary Care Records. The Department concluded that the opt-out model was 
preferable on the grounds that the alternative approach would: 


(1) take considerable time to implement and therefore delay the delivery of the benefits associated with 
having a Summary Care Record; 

(2) disadvantage the most vulnerable members of society who may benefit most from the new record but 
may not be provided with one for a considerable period, or who may be difficult to contact to gain 
consent; 

(3) require everyone to take action when, based on the experience of other countries who have 
implemented similar electronic records, only a very small minority will request not to have a Summary 
Care Record at all; 

(4) potentially result in complaints and litigation where health outcomes would have been improved if a 
Summary Care Record had been created. 

19. The NHS has always operated on an opt-out or implied consent basis for sharing information about 


patients. This is in line with the NHS Confidentiality Code of Practice and the Care Records Guarantee. 
What will change with the introduction of the new systems is that when patients request that information 


is not shared, it won’t be. 
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20. The approach taken therefore allows patients to opt-out of storing and/or opt-out of sharing medical 
information on the Summary Care Record. It is supported by a comprehensive communications programme 
to ensure that people have the information in time to determine their preference about a Summary Care 
Record. The Ministerial taskforce (including the BMA, the Society of Emergency Medicine and various 
patient organisations) unanimously supported the Department’s approach. 


21. Itis stressed that the assumption of implicit consent (ie the opt-out approach) relates only to the initial 
setting-up of the Summary Care Record and the inclusion of medication, allergies and adverse reactions. 
The next stage of adding the patient’s significant medical history will occur only after a discussion between 
the patient and their GP and therefore requires explicit consent (ie opting-in) unless there is a lawful basis 
for recording information without consent, eg when a patient lacks capacity. The inclusion of future health 
episodes will continue to be for discussion between patients and clinicians. 


22. The result of the approach taken is that patients may choose whether to have a Summary Care 
Record; may choose what is in it; may restrict who may see it; and may view it themselves through 
HealthSpace, a website with registration and access controls. Patients will need to register to get access to 
their HealthSpace record, which will provide them with access only to their own Summary Care Record, 
including visibility of their participation options. HealthSpace will also allow patients to view any personal 
data that they have chosen to keep private. 


23. Evidence from Scotland, Hampshire and our Early-Adopters is that only around 0.25% of people 
object to having a Summary Care Record. 


24. University College London (UCL) has been contracted to conduct an independent evaluation of the 
Summary Care Record Early-Adopter Programme. Their team is led by Professor Tricia Greenhalgh, 
Professor of Primary Health Care UCL who is also a practising GP. The evaluation commenced formally 
in May 2007 and will run for one year. The aim is for the final report to be published in the summer of 2008. 
In the meantime, any emerging findings will inform the continued implementation of the Summary Care 
Record under the early-adopter phase as well as the subsequent national implementation, scheduled to begin 
in 2008. 


SEALED ENVELOPES 


25. Patient sealed envelopes provide the mechanism whereby patients can restrict access to the parts of 
their Summary Care Record they consider to be particularly sensitive. Patients will be able to request that 
parts of their record are either “sealed” or alternatively “sealed and locked.” These procedures form a level 
of access control deployed at the direction of a patient, not the NHS. Although the coordination of sealing 
decisions across multiple IT systems and the Summary Care Record is new and challenging, functionality 
which is analogous to sealing is already in many of the new systems being deployed. For example TPP/ 
System One, a GP IT system being deployed by CSC, has functionality called privacy markings. It is 
therefore wrong to characterise the functionality as new or untested. 


26. Sealed information will be recorded on Summary Care Record and system users will be aware that 
some information has been sealed. However, access to the sealed information from outside of the team 
recording it will be obtainable only with the patient’s consent; in exceptional circumstances (eg child 
protection or serious crime investigations); or if it is permitted or required by law. Only those users with the 
necessary privileges will be able to gain temporary access to sealed information without the patient’s 
consent. A privacy officer will be alerted to the temporary access by any user and patients registered with 
HealthSpace will receive a notification when access permissions are changed or when temporary access is 
gained. 

27. Sealed and locked information is not transmitted to the Summary Care Record and cannot be 


accessed outside of the team that recorded it. Users who do not have permission to access the sealed and 
locked information will be unaware of its presence. 


28. Sealed information will be available to the Secondary Uses Service (SUS), but will not be disclosed 
in an identifiable form. Sealed and locked information will not be available to SUS. 


29. NHS Connecting for Health has specified the functionality required to provide a uniform service for 
the sealed envelopes across the NHS and the link to the Spine. The Spine elements of this will be in place in 
2008. Sealing functionality in the LSP systems will continue to be upgraded with successive software 
deployments until it meets the required specification. NHS Connecting for Health is now working with 
suppliers to agree implementation plans. 


SYSTEM SECURITY 
External system security 


30. The new systems will be protected by state of the art security measures capable of providing far 
greater protection than has ever been the case previously. The NHS patient database (the Spine) will reside 
within a fully private network known as N3. The Spine system and database can be accessed only from 
within this private network. Should an attacker somehow gain access to the NHS private network they 
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would then have to break through three separate layers of tiered architecture—each tier being protected by 
twin firewalls (of different manufacture) to access the database. The firewalls are supported by intrusion 
detection systems and other multiple security measures, which monitor network traffic routinely and raise 
an alert on the detection of suspicious activity. 


Avoiding misuse of the systems 


31. There are four distinct levels of controls to protect against the danger of data theft by a legitimate 
user. 


(1) The first control is provided by all users needing to have a smartcard. Smartcards are secure tokens 
that, together with a password, confirm the identity of staff and determine access rights to information 
in line with the highest level of government standards. They are issued only when satisfactory evidence 
of identity and residence is provided in person by the staff member, for example by the production of a 
passport and utility bill. Smartcards provide a unique digital identity that enables the system to know 
precisely who each user is. 


(2) The second control is that staff will be able to access only information that is relevant to their role 
within the healthcare team, so a receptionist will see information about an appointment, but will be 
unable to look at detailed clinical records. 


(3) The third control is that the system will not permit anyone to access clinical information unless they 
are registered within the system as working in a team that is providing the individual patient 
concerned with care or are checking the quality of care provided—a new and powerful safeguard 
referred to as a legitimate relationship. 


(4) The fourth control is provided by the staff who oversee compliance with the security processes. A 
record is kept within the system of who has done what and if an irregularity is suspected these staff 
will be alerted automatically and will investigate the incident. 


32. The Department has produced what it believes is the most comprehensive privacy statement of any 
public service in the form of the NHS Care Record Guarantee for England, setting out twelve commitments 
the NHS makes to patients in order to protect their confidentiality. 


Secondary uses of the data (for research and analysis) 


33. The NHS uses patient information for many purposes other than the provision of care and treatment, 
for example for research, audit, management and public health surveillance. The Secondary Uses Service 
will enable data from the full national patient database to be accessible to healthcare professionals, 
whenever and wherever it is needed. 


34. Confidentiality will be protected through the use of sophisticated anonymisation and 
pseudonymisation processes, either removing patient identifiers or replacing them with codes. Patient 
identifiable data would be used only where there is consent or a legal basis for disclosure. 


35. The Committee received very strong evidence, both oral and written, that the use of patient data for 
research provided overwhelming benefits for patients of the NHS. The key points made were that patients 
should have unique identifiers; that explicit consent cannot always be obtained in advance; that data is 
required at an individual level; but that individual identity is of no interest. All parties to this evidence 
stressed that good information governance is a prerequisite, including the optimum anonymisation as 
appropriate to the case. The Department supports this evidence and two expert groups are providing advice: 


(1) The Care Record Development Board has established a Working Group to report on the policy and 
ethical issues around the use of information in the National Care Record Service to support research 
and other secondary uses of information in compliance with the Care Record Guarantee and the 
secure and ethical use of patient records. The Working Group is chaired by Professor Sir Robert 
Boyd, Greater Manchester NHS Research and Development Director, and includes representation 
from key stakeholders including patients, groups representing patients, the BMA, the Academy of 
Medical Sciences, the Wellcome Trust and the GMC. The report of the Working Group is due shortly. 


(2) A UKCRC expert group chaired by Professor lan Diamond, Chief Executive of the Economic and 
Social Research Council, is advising NHS Connecting for Health on maximising the benefits of the 
NHS Care Record for research. It commissioned four simulations to show in detail how the design 
of clinical trials; large observational studies; and surveillance of the effects of treatments could draw 
on the NHS information infrastructure. It reported recently. 


The two groups have cross-group representation and have held joint meetings. 
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DELAYS TO THE PROGRAMME 


36. The aim of the programme has been to deliver new systems which are fit for purpose and which 
support the delivery of key benefits without compromising patient safety. The Programme also has to be 
responsive to changes in policies and priorities, and to technological developments, all of which are 
inevitable over a 10 year period. The approach is necessarily flexible. 


37. The following are examples of products that have been delivered: 
— Quality Management and Analysis System (QMAS) 
— N3 broadband implementation—1 9,687 connections 
— Bowel Cancer screening 
— Technical development of Picture Archiving and Communications Systems (PACS) 
— Deployment of 95 PACS systems 
— Technical development of Choose and Book 
— Technical development of the Electronic Prescription Service (EPS) 
— Deployment of 4,832 EPS systems 
— Deployment of 27 Acute Patient Administration Systems 


— Infrastructure for the NHS Care Record Service, including Personal Demographics Service (PDS), 
Security and Authentication Systems and Messaging Systems. 


38. Many thousands of systems at local and national level are operating effectively every day. Whilst 
some elements of the Programme are delayed against the original timetable, substantial new systems have 
been added and many delivered on time and ahead of time. Key examples of additions to scope are: 


Reason Product 


Improving Patient Benefits — The choice element in Choose and Book; 
— Option to nominate dispensing location in EPS; 
— Patient medication record within the EPS; 
— Payment by Results 


— PACS 
Improving the benefit to clinicians and — Payment by Results 
other professional users — PACS 
Making the system more convenient and — QMAS for GPs to record, clinically code and 
easier to use manage their patients’ medical conditions. 
Improving clinical safety — Bowel cancer screening 

— PACS 
Improving organisational efficiency — NHSMail 


— Payment by Results 





39. Introduction of the Summary Care Record was deferred by around two years against the original 
plan. This was due partly to its complexity and partly to the need to secure consensus from the medical 
profession on its contents. Although the implementation of the Summary Care Record itself was deferred, 
work continued on the necessary infrastructure. 


40. The Spine was launched in 2004 and the central database, known as the Personal Demographics 
Service (PDS), has become crucial to the effective running of the NHS. The PDS was deployed on time and 
to budget in July 2004. The number of enquiries made of the PDS service in an average week is in excess of 
seven million with over 250 million enquiries handled to date. The NHS Summary Care Record is now 
very advanced in the first early-adopter sites within Bolton Primary Care Trust (PCT). A further five PCTs 
have plans in place to begin the Public Information Programme as a preliminary to implementing the 
Summary Care Record. The early-adopter phase will provide evidence and experience to support the full 
implementation of the Summary Care Record. 


41. Although the Programme is the largest single IT investment in the UK to date, it is not a single 
monolithic system due for delivery or go-live at one point in time. The Programme comprises a range of 
new and existing systems, introduced incrementally and meeting the Programme’s objectives over time. For 
example: 


— over 80 versions of software from existing IT suppliers have been through the compliance process 
for use within the NHS, resulting in significant improvements in the quality and reliability of the 
software involved; 


— existing NHS systems have been utilised to deliver new functionality; 
— the LSPs’ plans are all based on delivering incremental improvements; 
— _ new systems are deployed in phases agreed with the SHAs. 
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DISTRIBUTED VERSUS CENTRALISED DATABASES 


42. There has been an assumption, on the part of some commentators, that patient data for an individual 
is held on a single central database. In practice, the Programme uses a combination of distributed and 
centrally managed databases, depending on the nature of the application. 


43. Centrally managed databases allow greater scope for sharing data and for the application of 
consistent controls on the use of the information. The NHS Care Record Spine is an example of a centralised 
database, designed to serve clinicians across England by providing access to the patient’s Summary Care 
Record. However, such databases are always designed for resilience and, in line with best practice, the data 
is actually held across multiple databases and data centres. 


44. The detailed records exist on distributed databases. These are smaller database deployments that 
involve databases managed by existing IT system suppliers and LSPs. The key to ensuring interoperability 
is the consistent application of standards and demonstrations of system integration compliance to support 
information sharing. 


45. As with the centrally managed databases, LSPs are required to design for resilience and to have 
multiple databases and data centres. The existing system suppliers are working towards similar standards. 


46. The approach takes into account the nature of the application, for example locally used or requiring 
national access; technical constraints such as resilience and business continuity; and the clinical need to 
access information at either a detailed or summary level. 


Department of Health 
12 June 2007 


Further supplementary evidence submitted by the Department of Health (EPR 01C) 


NOTE ON COMPATIBILITY WITH EUROPEAN LAW 


I promised to write with clarification on whether the summary care record and the secondary uses service 
are able to satisfy the requirements of European law in respect of data protection. 


I can confirm that our legal advice, and the advice of the Information Commissioner, is that the various 
elements of the National Programme for IT are designed to enable users to be fully compliant with the Data 
Protection Act 1998, the domestic legislation that gave effect to the European Directive on Data Protection. 


You raised the question of some possible future challenge over compliance with European legislation. It 
is my understanding that this possibility has been mooted in relation to a draft European Working 
Document rather than to existing European law. The Working Document is currently out for consultation 
and the Department of Health, along with numerous other UK bodies, have responded with suggestions for 
clarification and amendment. 


If this document remained unchanged and was accepted as the interpretation of law that the European 
Courts adopt in the future, there would be questions about our compiiance. Essentially the Working Group 
has suggested that it may be difficult to provide electronic health records with a robust legal basis under the 
European Data Protection Directive and that member states should consider providing such records with 
a clear basis in domestic law. This applies equally to existing electronic health records and should not be 
seen as an issue originating with, or exacerbated by, the summary care record or other new developments. 


Working Documents are issued for consultation purposes. They do not represent agreed legal 
interpretation and have no legal weight attached to them. We expect that the Working Document will be 
amended to better reflect the realities of team based modern healthcare and to allow for the impact of UK 
domestic common law of confidentiality that runs alongside data protection requirements. The Information 
Commissioner is represented on the group that is drafting the Document and his staff are confident that the 
final document will not require any significant change to UK practices. 


Lord Hunt of Kings Heath 
Minister of State for Quality, 
Department of Health 


29 June 2007 
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Supplementary evidence submitted by Professor Brian Randell (EPR 20A) 


INTRODUCTION 


1. At the Committee’s second evidence session, Dr Richard Taylor asked Professor Brian Randell to 
provide a short note describing where independent technical reviews had previously helped major projects 
to succeed. This supplementary evidence has been prepared in response to that request. 


EXAMPLES OF INDEPENDENT REVIEWS 


2. In 1998, the project to develop the New En-Route air traffic control centre (NERC) at Swanwick was 
three years late, over budget, and facing continuous scrutiny by the press! and by the Parliament. Mrs 
Gwyneth Dunwoody MP, as Chair of the Transport Committee, called for an independent review of NERC, 
and this was carried out by DERA (now QinetiQ)? and Arthur D Little. The review reported that the project 
was likely to succeed if a number of technical and management recommendations were implemented. One 
conclusion was that the Chief Executive Officer had such a powerful commitment to the success of the 
Project and this “very likely inhibited more open discussion at such meetings on project problems and 
possible Operational date slippage. This in turn stifled debate and helped reduce the effectiveness of the 
review meetings”. The recommendations were followed and NERC came into service in 2002; it has proved 
very successful in operation. 


3. In MoD there is an Annual Major Projects Review, which is published. It would make sense for all of 
the major programmes across Government to be included in an Annual Major Programmes Review similar 
to the MoD Major Project Review. This would get the facts about those programmes into the open on a 
regular basis for scrutiny and debate. 


4. In the USA, the Office of the Undersecretary of Defense introduced a programme of independent 
project reviews in 1999 (the Tri-service Assessment Initiative). A status report’ states that “As a direct result 
of the assessments conducted to date (19 since inception), Project Managers are implementing relatively low- 
cost post-assessment recommendations and realizing high returns.” 


5. A report by Jack Ferguson, director of Software Intensive Systems for the US Department of Defense° 
describes their independent expert programme reviews. 


At the DoD, our large development efforts face problems with the lack of software management 
expertise and of real data on the causes of problems. To address these issues, we are implementing 
independent expert program reviews (IEPRs) at appropriate points in the system life cycle. The 
Defense Science Board Task Force on Defense Software made this industry best practice its top 
recommendation. IEPRs leverage the scarce technical talent resident in government and industry 
to help DoD program managers better understand risks, problems, and best practices. 
Independent expert teams provide a comprehensive assessment of the programs, identify risks, and 
make recommendations for management and risk mitigation. Participation in these assessments 
is voluntary; program managers request assessments and control assessment report distribution. 
The review team and program staff jointly establish assessment scope and initial issue areas. They 
also establish a follow-up review schedule to evaluate actions taken as a result of the assessment. 
To date, 42 such IEPRs have been performed. Besides significantly reducing the overall risks on 
the programs reviewed, the IEPR results are giving the DoD stronger experience based insights 
that help software-intensiveisystem programs as a whole. Based on generic, systemic issues found 
across the assessments, IEPRs give feedback to DoD and senior acquisition managers, identifying 
recommended changes in policy, education, and training. These findings let us base risk mitigation 
and process improvement decisions on real data rather than anecdotes. They also provide 
information on the unintended consequences of well-meaning policy directives. 


6. The MITRE Corporation and the Software Engineering Institute (SEI) in the USA both frequently 
review major programmes for the US Department of Defense. The SEI’s publication on lessons learned from 
independent technical assessments® contains the following summary. 


All of the assessments summarized in this paper were on large scale, DoD (or related government 
agency) programs. All of the programs were in actual or perceived difficulty. Some of the 
recommendations were for substantial restructuring or cancellation of the effort. With this in 
mind, we look to some of the root causes of the problems uncovered, and attempt to compare and 
contrast them to similar works in the non-defense world. In doing this, we find that there are more 
similarities than there are differences. The most significant drivers to failure on these systems 
continue to be management and culture related, just as they are in commercial systems. 





' http://news.bbc.co.uk/1/hi/uk/politics/75220.stm 

? http://www.qinetiq.com/home/case—studies/aviation/swanwick—air—traffic—control—centre.html 
3 http://www. publications. parliament.uk/pa/cm199899/cmselect/cmenvtra/586/586mem01.htm 

4 http://www.stsc.hill.af.mil/crosstalk/2000/11/baldwin.html 

5 IEEE Software, July/August 2001 

° www.sei.cmu.edu/pub/documents/01 .reports/pdf/01tn004. pdf 


The Electronic Patient Record: Evidence Ev 125 





Technological failings, while they exist, also have a strong management flavor, as they tend to 
cluster around failings in the systems engineering process. There are no technology “silver bullets,” 
and anyone promoting any technology as a panacea should be viewed with suspicion. A recent 
Defense Science Board report states: “Too often, programs lacked well thought-out, disciplined 
program management and/or software development processes. . . . In general, the technical issues, 
although difficult at times, were not the determining factor. Disciplined execution was.”. There are 
numerous examples as to how this lack of disciplined execution manifests. Some deficiencies are 
related to human nature. Self-interest leads people to primarily consider their tenure on a job, 
cleaning up problems left for them by their predecessors and often not considering long-term 
consequences of short-term decisions. There is also a tendency to try to place blame on other 
organizations: customers and program offices cannot hold to a set of requirements; contractors 
don’t live up to their obligations; vendor’s products don’t live up to their performance and 
capability claims. It is obviously someone else’s fault. This is all a case of lack of discipline. We 
find that in programs in trouble, there are NO innocent parties. All stakeholders involved 
participated (at some level) in creating or abetting failure. 


7. According to Dr Robert Charette (who was chief designer of the IEPR process referred to above), the 
US National Academy of Science and Engineering routinely carries out reviews of troubled programmes 
and makes recommendations to help them to succeed. Dr Charette has taken part in many reviews, including 
the post-Challenger shuttle review for NASA,’ and he is willing to provide personal evidence to the 
Committee if you request him to do so. Dr Charette is also author of a recently-published article reviewing 
American and other efforts to develop national healthcare IT systems.* 


8. I and other members of the UK Computing Research Committee have participated in many 
independent project reviews for public-sector and private-sector organisations. The systems reviewed 
include large (several million lines of software), distributed (many scores of processors), information systems 
processing large quantities of real-time data. Many have involved complex supply chains, with suppliers in 
the UK and overseas—mainland Europe or the USA—with complex, multi-party (including multiple 
government agency) procurement organizations. Several have had challenging programmes, with multiple 
deliveries and complex integration activities to carry out prior to delivery. On several occasions, these 
reviews have occurred late in programmes. Whilst there are more opportunities and alternatives for 
improvements early in a programme, our experience is that it is usually still possible to identify courses of 
action which significantly improve the likelihood of successful project outcome. 


UK Po.uicy 


9. The Information Tribunal has recently ordered the Office of Government Commerce (OGC) to publish 
its Gateway reviews of the ID-card programme. In response to the decision, the information commissioner 
Richard Thomas said: “Disclosure is likely to enhance public debate of issues such as the programme’s 
feasibility and how it is managed”. It seems likely that the same ruling would apply to NPfIT. 


10. On 3rd April 2000, the Committee of Public Accounts published its Session 1999-2000 Thirteenth 
Report entitled “The 1992 and 1998 Information Management and Technology Strategies of the NHS 
Executive”. This report concluded (paragraph 39 & 40) 


“Evaluation of the success of IT projects is essentially to identify lessons learned and avoid the 
same problems in future. We have previously expressed our concerns about the failure of the NHS 
Executive to evaluate important aspects of the 1992 Strategy in its reports on the Hospital Support 
Systems Initiative and Read Codes. .... The Executive assured us that they are committed to 
evaluation of ongoing projects .and of the 1998 Strategy. But they have yet to develop their plans 
in detail. We expect the Executive to produce a programme for these evaluations, and to let us see 
it as soon as possible”. 


11. Hence the Committee of Public Accounts recognised as long ago as the year 2000 that evaluation of 
projects while they were still in progress is a potentially valuable act. In response, the Department of Health 
commissioned two reviews of direct relevance to the Health Committee’s enquiry. Between August and 
October 2001, Professor Denis Protti, School of Health Information Science, University of Victoria, 
Victoria, British Columbia, Canada was commissioned to review “the state of progress of Information for 
Health”. His report (the Protti Report) contains many pages of detailed recommendations. It was 
undoubtedly critical. In response, in 2003, the Department of Health commissioned a report from the PA 
Consulting Group (Core National Evaluation of the Electronic Records Development and Implementation 
Sites). This report also made a number of important recommendations. 


7 Such reviews by the National Academies of Science are routinely published, and play an inportant part in restoring public 
confidence in troubled projects. An Assessment of Space Shuttle Flight Software Development Processes, R. Charette 
(Chairman). Commission on Engineering and Technical Systems, National Research Council, (National Academies Press, 
1993), 194 pp. [http://books.nap.edu/openbook.php?isbn =030904880X] . 

8 R Charette, “Dying for Data: A comprehensive system of electronic medical records promises to save lives and cut health care 
costs-but how do you build one?,” IEEE Spectrum, vol. 43, no, 10, pp 22-27, 2006. [http://www.spectrum.ieee. org/oct06/4589] 
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12. Between April and July 2003, the Department of Health commissioned a review “The Public View 
on Electronic Health Records”, conducted by the Consumers’ Association and the researchers they 
commissioned: Research Works Limited (qualitative) and BMRB International Limited (quantitative). 
This report’s findings are fascinating and its recommendations are most interesting. 


13. The difficulty is that Connecting for Health appears to have largely ignored the recommendations 
made in these reviews. If they have not done so, they should be invited to explain to the Health Select 
Committee which recommendations they have implemented and how they have implemented these 
recommendations. 


CONCLUSIONS 


14. The Health Select Committee may wish to address two issues: (a) having independent timely 
information, which can only come from a thorough independent review; (b) monitoring that the 
Department pays attention to the review report, through a continuous programme of Health Select 
Committee scrutiny of the Programme. In this context, it may be worth noting that the House of Commons 
Work and Pensions Sub- Committee (Report HC 311-I Published on 14 July 2004) (paragraph 26) says: 


“We recommend that, as formal evidence to Parliament, the Department should present an 
implementation assessment for each major IT project. We envisage that such an IT 
Implementation Assessment (ITIA) would be similar to a Regulatory Impact Assessment (RIA) 
that is currently required. An ITIA should set out in some detail the Government’s justification 
for embarking on the IT programme, including purpose, timings, costs, IT requirements and 
major risks.” 


15. In many ways the review recommended by Professor Randell, on behalf of the 23 academics, would 
produce an independent IT Implementation Assessment similar to that proposed by the House of Commons 
Work and Pensions Sub- Committee, which together with the Department’s response may move the 
National Programme for IT genuinely forward. 


16. Please let me know if you would like me to provide the Committee with any of the reports or other 
documents referred to in this evidence. 


Dr Martyn Thomas 
May 2007 


Supplementary evidence submitted by BT (EPR 51A) 


1. BT was awarded the contract as Local Service Provider for London in December 2003 to design, 
deliver and operate the integrated local patient record applications and systems for all care settings in the 
capital. BT is progressively replacing and updating networked IT facilities in NHS hospitals, clinics and GP 
surgeries and working with NHS staff to ensure they are able to make the best use of national applications 
being introduced as part of the NHS National Programme for IT. 


2. BT is now making good progress in London and has delivered significant capability to more than 50 
out of 74 Trusts, particularly to Primary Care Trusts and Mental Health Trusts. At the end of March, BT 
completed the rollout of Picture Archiving Communication Systems (PACS) to the remaining 21 trusts in 
London, where PACS is now in use in every hospital in London, every day. 


3. Whilst BT has been deploying valuable capability across the NHS, progress in delivery to Acute 
Hospitals has been slower than was originally anticipated. BT has therefore taken steps to improve its Acute 
clinical application delivery. In agreement with NHS CfH and NHS London, and following a strategic 
review of its suppliers, BT made significant changes to its subcontractors in 2006, which included the 
replacement of IDX with the Cerner Millennium solution. 


4. This switch to Cerner together with a strategy of providing an integrated solution employing Cerner 
(Acute), InPractice (Primary Care) and RiO (Community and Mental Health) removes risk from the 
delivery strategy by moving away from a “single vendor” strategy, and uses products that the NHS has 
deployed and “trusts” in the field. 


5. The execution of this revised strategy is proving successful. In particular, great progress has been made 
in Mental and Community Health care settings, with half of all London’s Mental Health Trusts having had 
new IT systems installed. Two trusts in London (Newham and Homerton) deployed upgrades to their 
Cerner systems late last year. There are plans to go live at Barnet and Chase Farm later in the summer and 
two further deployments are planned later this year. Comprehensive plans have been agreed with NHS CfH 
to continue this programme of work across all care settings in 2008 and beyond. 
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6. A key element of BT’s strategy has been to install products initially as “standalone” deployments and 
then to integrate them with the Cluster-wide solution. Each of BT’s key suppliers is modifying its product 
to facilitate integration, which is planned to commence in 2008. This may also allow some integration of 
legacy systems and products. BT will ensure these applications are seamlessly integrated to support the 
vision of a “single view” shared patient record across acute, primary and mental health settings. 


7. BT is committed to: 
— working in partnership with NHS London and Trusts; 


— continuing the level of deployments across all care settings, with a definite pathway for acute 
deployments; and 


— ensuring the integration of a shared patient record across all care settings. 


British Telecommunications 
6 June 2007 


Supplementary evidence submitted by BT Health (EPR 51A) 
Figure 1 
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Figure 2 
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The Spine is a national central database which will revolutionise the way 
patient care is delivered by the NHS. Developed to lie at the very heart of the 
NHS National Programme for IT, the Spine will store electronic medical records 
for England’s 50 million plus patients. All patient information is held securely 
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of all the National Programmes applications and is vital to the NHS CFH 
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BT Health 
June 2007 


Evidence submitted by Dr Paul Cundy (EPR 73) 


BACKGROUND 


In advance of my oral evidence session with the Health Select Committee on 26 April, I outline further 
consideration from the Joint General Practitioners’ IT Committee (JGPITC). The JGPITC is a committee 
jointly constituted by the General Practitioners Committee of the BMA (GPC) and the Royal College of 
General Practitioners (RCGP). It has membership of roughly equal numbers from the GPC, the RCGP, GP 
computer system user groups, in addition to observers from NHS Connecting for Health (CfH) and the 
British Computer Society. It is the senior committee mandated by the GPs of the UK to deal with, and advise 
upon, GP IT matters. 


I would like to make clear that the views expressed in this document are not necessarily those of the either 
the British Medical Association, or the Royal College of General Practitioners. 


99.97% of all GPs now routinely collect clinical data on a wide variety of chronic conditions. Some GPs 
have approaching 20 years experience of using exclusively electronic records. Possibly 50% or more of all 
GPs now consult “paperlite“”, that is without the use of paper records. 


GPs are by far the most experienced users of IT systems in the NHS, they are the NHS’s experience and 
evidence base in the use of electronic records. In addition, GP have driven the use of IT systems in healthcare 
and continue to be amongst their strongest advocates. It would be incorrect to describe the GPs as against 
the National Programme for IT. 


Some of the main areas of concern regarding the Summary Care Record (SCR) are set out below. 


CLINICAL ENGAGEMENT 


It is accepted that clinical engagement has been poor until recently, as stated in the recent National Audit 
Office report, but the assumption has been that this was due to error rather than a more active process. As 
far as GPs are concerned, the evidence we have attached in appendix 1 suggests that the National 
Programme, as it was then known, actively decided not to engage with the relevant representative, and 
therefore accountable, bodies. I would like to make clear that the information contained within appendix 
1 is intended for the Select Committee’s consideration only. 
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CONSENT 


It is self evident that patients, should control what happens to their information. Every body or 
organisation external to CfH has come out in favour of the “opt in“” or explicit consent model. Despite this 
CfH, presumably under political direction, persists with the lesser “opt out“” model. Even the programme’s 
own internal ethical advisors stated: “the only way to demonstrably satisfy the requirements of the common 
law of confidence is through an opt in process (sic)“”. Our committee considers this persistence in ignoring 
all calls for the “opt in“” approach to be very worrying and in the long term more damaging for the SCR. 
We believe it is far better to build an SCR slowly and on the basis of absolute and enduring trust. 


We are very concerned at CfH’s insistence that section 10 of the Data Protection Act 1998 should remain 
the exit justification for patients who do not want a SCR. We believe this is counter to Lord Warner’s verbal 
assurances and also all ethical, professional, moral and legal principles. 


A FALSE SENSE OF SECURITY? 


Many of the theoretical protections promised by CfH for patient data have yet to be actually delivered 
and their scope and specification is being downgraded as technical difficulties arise. We have serious 
concerns about another potential problem in that the protective technologies promised for patients 1) are 
not yet in place even though data is being accumulated and 2) may never be in place. 


Sealed envelopes and Role Based Access controls have both been heavily watered down since first being 
proposed and we believe that they will offer very little of the initial protections promised. 


We also have proven evidence that security controls are being “worked around” in various places in 
the NHS. 


If significant changes to the privacy protection arrangements occur, patients and GPs need to be made 
fully aware so that they can re-evaluate their position. If, for example, Social Services staff were ever to be 
granted access to the SCR, I believe that many patients would want their records withdrawn. 


THE SUMMARY CARE RECORD 


The Summary Care record shows signs, even in the early adopter pilots, of rapidly becoming far more 
than merely just a “Summary” care record. This “scope creep” will create great concern amongst GPs whose 
records necessarily contain large amounts of contextually sensitive information. 


Whilst some argue for a widely available “summary” record to assist in unplanned or emergency care the 
records being created under the Early Adopter Pilots will be far more than just summaries, indeed they have 
the potential to become nothing short of an ongoing finely detailed event by event accumulation of the 
entirety of the locally held GP record, in short a mirror copy. 


Thus far all debate has been about the concepts and issues of a “summary” record. The public information 
campaigns are focused on this aspect yet the records being created are not summaries. I believe this is yet 
another area of considerable concern firstly because the public have been misled and secondly because of 
our experience of electronic patient records (EPRs) as day to day tools. 


It is assumed by protagonists that the SCR will improve safety. I know of no evidence that the SCR per 
se will improve patient safety. GPs know from their day to day use of their local computer record systems 
that they are not the panacea, they are not fault free. It is possible for computer records to be just as 
inaccessible and just as confusing for the user as any paper record. Prescription errors occur with computer 
systems just as they do with paper based systems. The experience from within general practice is that these 
risks are mitigated by the concept of there being a “guardian” of the record; an agent or agency that is 
responsible for the maintenance of the record. It is recognition that electronic records are dynamic and 
require ongoing management. 

The SCR has no such person or organisation indeed I do not believe it is possible for the SCR to have 
one once it becomes a multi-contributor multi-organisational record. I believe the lack of an identifiable 
guardian responsible for the SCR will result in a decay of its value. 


MULTI-CONTRIBUTOR RECORDS 


Different practitioners have and need different sorts of records. A psychiatrist’s records will be almost 
purely narrative text whereas an intensive care physician’s will be represented by serial tests, measurements 
and results. One will be of almost no value whatsoever to the other. What each needs to know is the eventual 
outcome of the others involvement. The two doctors have no need to share the entirety of each others 
records, only the outcomes. The SCR is predicated on the former and not on the latter concept of 
interoperability. If the JGPITC’s offer to assist Mr Granger with his implementation of the NPfIT had been 
taken up we would have advised against a “one system fits all approach” and for a strategy of 
interoperability. This advice has recently been re-iterated in the British Computer Society’s review of the 


programme. 
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A UNIFORM CODING SYSTEM 


Most GP systems use a coding system known as Read codes. There are other coding systems used by 
secondary care. Exchanging or sharing data between systems that have disparate coding arrangements 
creates unnecessary complexity and introduces dangers. It is accepted that all systems in the NHS should 
use a common coding system and one has been identified; SNOMED. I understand that data in the SCR is 
to be held as SNOMED coded data but it will have been extracted from Read coded systems. Associated 
narrative text, which may be of great importance, may also have been removed. If this is the case there may 
be considerable safety issues. 


The aspirations of the NPfIT cannot be delivered until the NHS commits itself unequivocally to a 
common coding system for all NHS IT systems. 


EVALUATION 


There needs to be a rigorous evaluation of and genuine learning from the effectiveness of the pilots. After 
the pilots have taken place, the amount of data and the number of areas should be increased slowly and 
incrementally so that lessons can be learnt as appropriate. We are concerned that plans for rollout of the 
SCR are being made even before the evaluations have been commissioned. 


WORKLOAD 


General Practice is exceptionally workload sensitive as it bears the brunt of the interface with illness and 
does so on an ever more rapid turnaround time. Potential workload for practices must be recognised. The 
detail of the potential conflict between practice workload and fully-informed ongoing consent needs to be 
carefully teased out in conjunction with patients and the profession. Informed consent and clinician 
workload are the two most frequently stated concerns of GPs; getting the right balance between the two is 
of fundamental importance. Any model must also be appropriate for secondary care settings as well as 
minority groupings. 


MAINTAINING THE SCR 


Distinct from this practice level workload but as identified earlier the SCR will need to have its “guardian” 
if it is to have enduring value. Such guardianship will need to be resourced whether this occurs within or 
external to the practice. 


FAILURE? 


Another concern of the JGPITC is that should CfH be seen to “fail” a great opportunity will have been 
lost. The JGPITC is keen to be involved in any re-organisation that may or may not occur so as not to loose 
the fundamentals that underpin the NPfIT, which are increased funding for IT systems, modernisation and 
improved patient care. We have been concerned that the focus on small numbers of large scale suppliers will 
stifle innovation and may result in architectures being created that might limit the scope for any future 
salvage of the programme. 


Dr Paul Cundy 
Joint Chairman, Joint GP IT Committee 


24 April 2007 


Supplementary evidence submitted by Dr Paul Cundy (EPR 73A) 


Please find below my comments in response to the transcript of the hearing of the 26th April 2007. These 
comments are made on those points, or questions, not put to me but to the other witnesses. 


VESTED INTEREST 


In several answers it was implied that GPs were being protectionist in order to protect vested interests. 
The new contract for GPs of 2003 relinquished the GP monopoly on the provision of primary medical 
services; now anyone can hold a contract to provide primary care services. If a GP contract holder fails to 
deliver his contractual obligations he will loose his contract and the contract (and professional) obligations 
require him to handover his records upon termination. It therefore follows that a GP cannot protect his 
contract by erecting false barriers around his patients’ records. 
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Furthermore, the 2003 contract introduced the Quality and Outcomes Framework (QoF), a process by 
which up to one third of a GP’s income is linked to contract delivery. The performance assessment is made 
by automated monthly reports taken from his patients’ records system. This is the converse to protectionism. 


GPs ensure their self interest by opening up their record systems to automated external data extraction and 
reporting. 


CONFLICTS 


It is true that many GPs shoulder competing interests. My own personal circumstances are well know and 
widely publicised. This was an issue long before the National Programme for IT (NPfIT) arrived. In General 
Practice we dealt with this by amalgamating and mandating one committee as the “voice” of general practice 
during 1999 to 2001 (please see my separate earlier evidence on formation of the Joint GPC/RCGP IT 
committee), this committee reported back to its parent bodies (the GPC and the Royal College of General 
Practitioners) thus no individual is in a position to influence at either macro or micro level. All members of 
this committee are subject to election each year and the GPC co-chairman is subject to annual election. The 
RCGP co-chair is elected for 3 years. Conversely, it might be argued that everyone working for NPfIT has 
a tangible self interest. 


ALL “For” or “AGAINST” 


It is wrong to suggest that GPs are either for or against the NPfIT. NPfIT is a major project with many 
facets. Some elements are supported without reservation by GPs. For example, broadband access for GP 
surgeries (N3), GP2GP transfer, the Electronic Prescription Service (EPS), some elements are supported but 
with reservations. Choose and Book, and others are a source of great concern. To suggest that any medical 
grouping can be so polarised is to underestimate the complexity of IT within the health community. 


Not ENGAGING WITH GPs 


GPs refute the suggestion that we have failed to engage and thus caused delays. In early 2003 the medical 
IT community met with Mr Granger and Professor Sir John Pattison. At that meeting Mr Granger was 
informed that in order to tap into GP opinion all he needed to do was to consult with one committee. We 
have previously submitted evidence that demonstrates our attempts to engage with NPfIT from 2003 
onwards. Meaningful engagement with representative and accountable GPs bodies did not begin until 2006. 


SHARING 


It is nonsense to suggest that GPs do not share patient information. GPs routinely share the entirety of 
a patients record when the patient moves to another practice. This equates to 10-15 million “shares” a year. 
GPs also routinely share information with secondary care specialists via the referrals process. This sharing 
is based upon the sharing with the specialist sufficient necessary information for the specialist to advise upon 
the patients problem. In this case the GP is not sharing the whole record; they share an extract that is deemed 
to be appropriate. The extract is then handed over to the other treating organisation. This limits the exposure 
of the extract to the minimum necessary to treat. This sharing occurs on behalf of about 10% of the 
population each year and for some patients many times each year. 


GPs also routinely, and probably more frequently, share information on a less formal basis with other 
members of the primary care team; practice nurses, district nurses, therapists, carers, OOH services etc. It 
is quite wrong to suggest that GPs are reluctant to share information when it benefits the patient. 


This GP view of sharing is distinct from the Connecting for Health (CfH) model, which is to put all of 
the patient’s data in one place and then “share” it by means of access control. Moreover, it should be 
remembered that the models in place in Scotland, Wales and also the Isle of Wight project are set up so that 
patient information is not accessed without explicit patient consent. 

GPs believe that the risks of the latter model should not be underestimated. There is an increased risk 
created by the data being in a place accessible to manifestly greater numbers of individuals. This risk needs 
to be balanced against any benefit that derives from the greater exposure but until the scale of the benefit 
has been quantified such proposals should not be implemented in anything other than pilots. 


Costs OF DELAY 


The costs of the delays to NPfIT are probably quantifiable. Costs can be hard financial ones as well as 
soft; there has been a considerable cost in terms of GP engagement with NPfIT but also government policy. 
Choose and Book may have been tolerated for longer had it been seen as CfH and GPs trying to develop a 


mutually beneficial tool. 
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The failure to deliver the IT agenda of the New GMS contract has lead to widespread disenfranchisement 
of GPs, particularly around system choice. The failure to engage with representative and accountable GPs 
who had expertise in GP IT has lead to systems being delivered that were not fit for purpose. The failure to 
engage and tap into the enthusiasm, experience and expertise of IT literate GPs is difficult to quantify but 
probably real. 


Delay has also caused “planning blight” for GPs, PCTs and Trusts and these can be quantified in terms 
of contract extension costs of existing systems. 


Finally it is possible to directly cost the failure to incorporate GP Choice into the LSP contracts; that being 
the cost the Treasury is now having to bear to put it into place—reputedly £80 million, which equates to 
almost ten per cent of the spend to date. 


Dr Paul Cundy 
Joint GP IT Committee, Joint Chairman 


10 May 2007 


Evidence submitted by Dr Chris Pounder (EPR 74) 


The Working Party of European Data Protection Commissioners has published a document on the 
privacy of medical data within an Electronic Health Records (EHR) system.’ The document states that 
unless there is a substantial public interest to the contrary, the patients’ wishes concerning the processing of 
their own medical data via an EHR system should prevail. There are several important elements which, at 
this late stage, I draw to the attention of the Committee. 


The Working Party has also concluded that centralized EHR system (ie on the UK model) “assumes there 
will be single controller for the whole system separate from the healthcare professionals/institutions’—in 
the UK’s case, this data controller could be the Secretary of State for Health.'° The Working Party notes 
that in such a system “liability for the confidentiality of the system is taken out of the hands of medical 
professionals”, and that this “might influence the amount of trust invested by patients into such a system”. 


The Working Party notes that risks associated with a lack of trust do not arise in a decentralized EHR 
system “where the health care professional/institution” is responsible for the medical file, or in patient- 
centric EHR systems (for example, the French EHR system) where patients exercise a significant degree of 
control over their own medical personal data. 


I should add that when the Government offers an “opt-out” with respect to the EHR system, it is assuming 
that it is the data controller and not the medical professional,'! as only the data controller has the obligation 
to offer the right to object to the processing found in section 10 of the Data Protection Act 1998. 


The Working Party states that “all data contained in medical documentation in electronic health records” 
should be considered to be “sensitive personal data”, even the “administrative data” associated with a 
medical record. The Party notes that if these administrative data “were not relevant in the context of 
treatment of a patient, they would and should not have been included in a medical file”. 


This does not appear to represent the position adopted in the UK, as it treats administrative personal data 
differently from those data which have a medical content. For example, the Statistics and Registration 
Service Bill'? before Parliament has excluded health personal data from the substantial degree of data 
sharing of administrative personal data (eg as contained in the Summary Care Record) on the grounds that 
these administrative data are devoid of medical content. 


The Working Party states that if patient consent is used as a basis of legitimising the processing of health 
personal data for other purposes, then such consent has to be freely given and fully informed. The document 
notes that it is “misleading” if the patient does not have “a genuine free choice and is subsequently able to 
withdraw the consent without detriment”. When giving consent, the patient must be made aware that he is 
“renouncing the special protection” granted to medical records (ie the prohibition on the processing of 
health data in the absence of such consent). 


The Working Party states that the processing of medical records within an EHR system can be legitimised 
by statute but only if that statute supports a “substantial public interest”. In assessing this public interest, 
the Working Party stresses the need to respect “self determination” of patients whereby the patients’ wishes 
with respect to the processing of their medical data plays a “significant role as a major safeguard”. 





° Working Party on the processing of personal data relating to health in electronic health records. 
'0 see section 251 of the NHS Act 2006. 


'! BMA may seek NHS records system boycott, http://www. out-law.com/default.aspx?page = 7603. 
'? Clause 40 permits the Secretary of State or other public authority to disclose patient registration information to the Board. 


The Electronic Patient Record: Evidence Ev 133 





This appears to contrast with the practice in the UK. For example, the Secondary Uses Service in the UK 
will consider wider uses of health personal data in the absence of consent. The position adopted by the 
Service is that if there is a substantial public interest for that secondary use, then there is no need to consider 
any aspect of “self determination”. 


The Working Party adds that the processing of health personal data can be legitimised on the grounds 
that the processing is undertaken by a health professional for a necessary “medical purpose”. The Working 
Party then state that “medical research” is not included within the meaning of “medical purpose”, and this 
implies that medical research by a health professional needs patient consent or has to be legitimised in terms 
of a “substantial public interest” where self determination is an important factor. 


Finally, the Working Party states that only those professionals who are “presently involved” with a 
patient should have access to the health record (eg this limitation should apply to access to the Summary 
Care Record), and that “a patient should have the chance to prevent access to EHR data if he so chooses”. 


In summary, it appears that there are several requirements, which the NHS’s own EHR system have yet 
to fully adopt. If I can be of assistance to the Committee, please do not hesitate to ask. 


Dr C N M Pounder 
Editor of Data Protection & Privacy Practice 


4 May 2007 


Evidence submitted by Professor Naomi Fulop, King’s College London (EPR 75) 


In relation to the term of reference as follows: “Current progress on the development of the NHS Care 
Records Service and the National Data Spine and why delivery of the new systems is up to two years behind 
schedule”. 


INTRODUCTION 


We have been studying in detail the processes and outcomes of implementing the NHS IT programme in 
four acute hospital trusts in England since October 2003. The study assesses the local context and progress 
made in each trust through in-depth interviews of staff over a two year period, alongside efficiency indicators 
derived from routine data.’ In August 2005 we reported findings from each trust’s baseline assessment and 
information gathered from the first round of interviews which took place between September and December 
2004.6 In this second phase, we re-interviewed the same senior trust staff, or new personnel in the same posts, 
to revisit the issues previously raised, to describe how they may have changed and to identify new issues that 
may have emerged. 


METHODS 


Baseline information was collected by meeting with key IT, finance and clinical directorate staff, 
document review, and from routinely published data. Data were also collected from two stages of 
interviewing. Stage 1 interviews took place over two phases, first, between September and December 2004 
(see earlier paper)° and then again between January and April 2006 (the focus of this paper). Stage | 
interviews concerned the implementation of the NHS IT programme. Stage 2 interviews investigated how 
specific IT applications were experienced by staff and impacted on working practices (not reported here). 


The data reported here are from the second phase of stage | interviews, with 25 senior NHS managers 
and clinicians in four acute trusts.. To enhance generalisability, we purposively selected four trusts which 
reflected a range of different organisational characteristics (Table 1). We chose trusts that served both urban 
and more rural populations. The trusts also differed in size, number of sites, in performance indicators and 
in their financial situation. They also differed in their level of e-function implementation. One site had a 
developed electronic patients record system, another site had not implemented any e-functions, whilst the 
remaining two sites had small pockets of implemented e-function.6 Participants were also selected 
purposively to include all local senior management staff involved in implementing the programme. At each 
trust these included the Chief Executive, Director of Information Management and Technology, Medical 
Director and Director of Nursing; these staff have responsibility for both fiscal and clinical probity. 
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TRUST CHARACTERISTICS IN 2003 


Trust 
Characteristic ] 2 Hy 4 
Size Large Large Large Small 
Number of main sites Bs 2 1 1 


[earlier merger] [earlier merger] 


Financial situation® Moderate deficit Small surplus Large deficit Small deficit 

<5m <10m <lm 
Performance indicators? 1 star 2 stars 0 star 2 stars 
e-functions present Site 1—none Site 1—e-orders None PACS 

Site 2—e-orders Site 2—e-orders 

PACs 
Expected date for PAS Unknown 2007 2006 2004-05 
replacement—in 2003* earlier adopter 
e-booking 





PAS—Patient Administration System. 

PACS—Picture Archive and Communication System. 

* Annual accounts for 2002-03. 

> CHI Clinical Governance Review 2002-03. 

* No patient administration systems were replaced during the study (2003-06). 


RESULTS 


Six main themes emerged from our earlier study:® 
1. The impact of multiple sites resulting from recent mergers. 
2. Poor communication between CfH and local managers. 
3. The impact of financial deficits. 
4. The need to prioritise performance targets. 
5. Supporting existing “legacy” IT systems. 
6. The delayed timetable for replacement patient administration systems. 


Eighteen months later, three of the previous concerns are still apparent (themes 2, 4, 5 below) and five 
new issues were raised: 


1. Increased support for the overall goals of the programme. 
. Continuing impact of financial deficits. 
. Managers distracted from implementing the programme by other priorities. 


2 
3 
4. Continuing poor communication between CfH and local managers. 
5. Continuing delay in replacing patient administration systems. 
6. Growing risk to patient safety associated with delays. 
7. Loss of integration of components of the programme. 
8. Discontent with Choose & Book. 
The eight themes are representative of all 25 staff interviewed. The issues raised were similar among staff 
interviewed in both phases of the research and those staff interviewed only in the second phase. 


Increased support for the goals of the programme 


Since the first round of interviews, we found that support for the concept underlying the programme had 
grown. The overriding view was that the NHS urgently needs the benefits that can be gained from IT 
modernisation implemented in a standardised way. (Box 1) We found very little resistance to IT 
modernisation, with interviewees reporting that their staff are ready, and sometimes “desperate”, for 
progress. However, alongside this growing support, we also found concern about the ability of programme 
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managers to deliver the programme. To maintain momentum, interviewees said that CfH needed to deliver 


products that work very soon. They also emphasised the need for independent evaluation to measure the 
benefits and costs. (Box 2) 


Continuing impact of financial deficits 


In our earlier interviews, senior staff in trusts facing financial difficulties were concerned about how to 
pay for the implementation costs associated with IT modernisation. Currently, financial difficulties within 
the NHS are even more widespread 14 and this issue has become more important. Respondents reported that 
making savings is now more critical and that applications which are part of the programme are not the 
bargain they were expected to be. Implementation of picture archive and communication systems (PACS) is 
also causing disquiet. Some respondents reported that PACS applications supplied through the programme 
appear to be more expensive than market alternatives (Box 3), but a central CfH mandate has left them with 
no choice but to implement the more expensive programme option. (Box 3) 


Managers distracted from implementing the programme by other priorities 


Financial deficits not only cause concern about how to pay for implementation of the programme, but 
also act as significant distractions for managers. In the earlier interviews, some trust staff reported that 
recent mergers and the need to prioritise attainment of performance ratings made it difficult to prepare for 
the programme. Eighteen months later, the priority of trust finances dominated. Two of our four trusts have 
had “turnaround teams” in place (external consultants brought in to help trusts resolve financial crises). One 
trust also has the Department of Health’s performance support team working with it. The dominant and 
immediate need to eliminate any overspend, whilst maintaining performance, appears to leave managers 
little time to commit to implementing the programme or any other new services or products. (Box 4) The 
programme was only reported to be a pressing priority in trusts where managers perceived a significant risk 
to patient safety from having to maintain existing legacy systems while waiting for new systems to arrive. 
(Box 8) 


Poor communication between Connecting for Health and local managers 


Previously, interviewees in all four trusts were concerned with a lack of clarity from CfH about the 
timetable for implementation. Eighteen months later, although respondents were enthusiastic about the 
goals of the programme, the perception of poor communication was unchanged. There is still uncertainty 
about the timetable for delivery of key components of the programme (eg core hospital administration 
systems compliant with the hardware and software applications that will make up the programme) and 
about the extent of financial assistance for “required” components. Respondents reported that much of the 
decision making has been between CfH and the local IT service provider. This lack of local involvement 
appears to have increased feelings of disempowerment and frustration. (Box 5) The uncertainty has also 
resulted in some trusts adopting policies that actively discourage staff from engaging with the programme 
(Box 6). 


Continuing delay in replacing patient administration systems (PAS) 


In the first interviews, respondents were concerned about when their PAS would be replaced. Originally, 
the national programme planned for PAS to be installed before any clinical applications. Due to delays in 
developing a PAS that can achieve connectivity with the “spine” (a nationally accessible summary patient 
record)!5 this plan has had to be revised and interim off-the-shelf applications are now being offered. The 
revised plan has slowed progress and trusts are still unsure when their replacement PAS will be implemented. 
Interim applications will allow trusts to move forward to some extent, but will not achieve the promised 
wider connectivity with other NHS hospital trusts and primary care teams. (Box 7) 


Growing risk to patient safety associated with delays 


Before the programme was conceived, NHS hospitals bought their own IT systems. When first 
interviewed, senior clinicians were worried that the replacement of these systems (often carefully customised 
to meet local needs) might result in a loss of functionality. This concern, though still evident in our recent 
interviews, has been largely superseded by the urgent need to replace legacy systems. When details of the 
programme were announced in late 2002, many trusts stopped investing in upgrading their existing IT 
systems, choosing instead to spend money on other priorities while waiting for applications compliant with 
the programme systems to be supplied. Delays mean that trusts in our study are still waiting for new systems. 
Where replacement systems were needed in 2002, the delay is now perceived to represent an unacceptable 
risk to patient safety, with trusts considering buying interim systems outside the programme. (Box 8) 
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Loss of integration of components of the programme 


The original goal of access to information across the NHS, that underpinned the NHS IT programme 
appears to have been lost.16 The lack of integration offered by interim applications has left senior trust staff 
questioning whether NHS-wide connectivity will ever be achieved and, if not, why trusts have had to wait 
several years for the new systems. The purchase of interim applications does not seem very far removed from 
how the NHS acquired IT before the programme, with the problems of this approach seemingly 
perpetuated, such as databases that cannot be accessed from outside the trust. (Box 9) Managers also 
questioned how the Government vision of decentralising clinical services, by increasing private sector 
provision, aligns with a centralised approach to information sharing. (Box 9) 


Discontent with Choose & Book 


Since the first round of interviews, acute trusts and local primary care teams have proceeded with 
implementation of Choose & Book, a system which allows GPs to make patient appointments and referrals 
into acute trusts electronically. We found little support for the patient choice element of Choose & Book 
(patients being able to choose to be referred to one of a range of hospitals) among the staff we interviewed. 
(Box 10) The technical problems affecting electronic booking have also undermined confidence in other 
planned applications. None of the managers or clinicians we interviewed were optimistic about the ability 
of CfH to deliver the systems. The doubts expressed were twofold; whether it was technically possible, and 
whether the products would be delivered in a reasonable time frame. Feelings of frustration were expressed 
at the slow progress. (Box 10) 


DISCUSSION 


Key findings 


Over three years from inception, and despite a number of setbacks and some hostile media coverage,'’ 
the programme remains an objective that many NHS staff support. In line with the National Audit Office 
report 4 all of our interviewees were enthusiastic about the goals of the programme. 


Set against support, were concerns about a lack of clarity and progress. Senior managers need to make 
financial savings and achieve efficiencies. Although IT modernisation should facilitate these goals, 
continuing uncertainty makes key managerial decisions more, rather than less, difficult. Trusts still do not 
know (a) what the local costs of implementation will be, (b) when a replacement patient administration 
system compliant with the programme will be available, (c) the timetable for delivery of interim applications, 
(d) the features of these applications and (e) the likely benefits and efficiencies from new systems (whether 
interim or planned). 


Ministers and senior civil servants have acknowledged that the total cost of the programme will far exceed 
the current budget of £6.2 billion but have not clarified how the additional costs will be met.18 It is not clear 
how much more implementation and additional “required components” will cost trusts, nor what cost 
savings might be expected after implementation. Trusts have also not received guidance on how to maximise 
possible savings by, for example, redesigning local work practices.* 


It has been difficult for trusts to prioritise the programme and engage staff when implementation 
timetables keep shifting. In the meantime trusts have employed a “patch and mend” approach to maintain 
existing systems. Major concerns over the risk to patient safety by continuing this approach have been 
expressed and reported elsewhere.'? Trusts are attempting to mitigate the risk by opting for interim systems, 
although delivery of these interim systems is also delayed.”? Purchasing interim systems outside the 
programme is also likely to be inefficient, if trusts subsequently have to buy new systems compliant with the 
programme during the lifetime of the interim system. 


The programme in wider context 


Although, the diversity of health care provision in other countries means projects on the huge scale of 
NPfIT are unlikely, the widespread implementation of electronic health care records is progressing in other 
countries.”! France has a national electronic medical patient record system planned for introduction in 2007, 
combining all consultations, procedures, treatments, drugs and medical devices prescribed. Similarly 
Australia is trialling a new national management system for electronic patient medical records, called 
HealthConnect.?! Creation of the Office of the National Coordinator for Health Information Technology 
in the United States also indicates a strong commitment from the current US administration to this task.” 


For these countries, an important lesson to emerge from the study is the difficulty in achieving an 
appropriate balance of responsibility between government and local health care organisations. Devolving 
control of IT to local managers can result in a lack of standards, and disparate functionality. Central control 
is equally problematic. The National Programme covers the entire NHS in England. The sheer size of the 
task has made progress slow. Effective communication and a shared commitment to the task, across all 
health sectors has been difficult. 
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Implementation of Choose & Book illustrates these difficulties. There was no integration of trust and GP 
IT systems and acute trust staff were unable to reconcile implementation timetables and goals for Choose 
& Book with their primary care colleagues. Although GPs derive substantial benefits from using IT systems, 
for the day-to-day running of their practices, these systems have been specifically designed to meet their 
business needs. The systems underpin relatively simple clinical functions,” but very effectively allow GPs to 
run their practices. GPs may perceive that they have little to gain from the programme and, importantly, 
can choose not to have applications of the programme imposed on them.?4 


By contrast, acute hospital trusts have to deal with more urgent and complex demands, requiring fast 
communication between hundreds of staff across many specialties and professional disciplines, yet the IT 
systems to support this activity are poor. Acute hospitals stand to benefit hugely from modernisation, not 
least in achieving the efficiencies currently demanded of them. For managers and clinicians in acute trusts, 
the programme is desperately needed and has to work. Independent procurement of IT systems, in the 
absence of national standards, has already been tried with little success.?5 


These difficulties have led to a third, middle way being tried; setting central standards but with local 
implementation. As recommended by the British Computer Society,?° CfH’s role is now shifting away from 
implementation towards providing a national infrastructure and standards-setting body. Implementation 
will now be devolved more locally, as set out in the NHS national business plan for 2007-08.2? Even with 
these changes the issues raised in our study, particularly in regard to risks to patient safety, still need to be 
urgently addressed. 


Strengths and limitations of the study 


The small number of participating trusts makes us cautious about generalising our findings. The trusts 
studied are located in only two of the five geographic implementation clusters. However, uncertainty over 
timetables and a lack of progress have been widely reported everywhere.*® Moreover, mergers of IT 
companies also mean that the trusts studied are being supplied by two of [now] four local service providers.”* 


Concerns raised by respondents, about performance and finance, are prevalent issues in the NHS but may 
be more salient in our participating trusts than nationally. We found no substantive differences in views 
among staff interviewed in the earlier phase of the study and those interviewed later. Staff interviewed were 
all senior NHS personnel. The 14 recent employees would, most likely, have been recruited from similar 
NHS posts elsewhere, suggesting wider generalisability. Another limitation of our study is the lack of a 
primary care perspective, which we have discussed above. 


Set against these limitations, ours is the only in-depth, longitudinal study of NHS IT modernisation. We 
interviewed a cross section of senior trust staff responsible for implementing the programme in NHS 
hospitals over a period of two years. These interviews have provided us with a detailed account of their views 
about progress, the challenges they perceive in implementing the programme in NHS hospitals and their 
information needs, in addressing these challenges. 


CONCLUSIONS 


The staff we interviewed were unreservedly in favour of IT modernisation but this support will quickly 
diminish unless more progress is achieved. In order to progress, and still maintain a vision consistent with 
the original goals of the programme, CfH needs to address the uncertainty experienced by trusts and take 
responsibility for advising about interim decisions. Trust managers urgently need concrete information, 
about implementation timetables, long term goals of the programme, and value-for-money. Finally, trusts 
need assistance to prioritise IT modernisation against other competing financial pressures, for example by 
including it in performance management frameworks. 


Professor Naomi Fulop 
School of Social Science and Public Policy 
King’s College, London. 
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We are very grateful to participating Trusts for agreeing to be cases, and to individual interviewees for their 
time and interest in the study. They are not named to preserve the anonymity of the Trusts. We are also grateful 
to members of the Steering Group for their continuing support. 


TeExT Boxes 


Box 1: Increased support for the overall goals of the NHS IT programme 


| still maintain it’s the right thing to do. I think the principle, the principles, the philosophy and the vision 
I think are absolutely sound. The challenge has been deliverability . . . (Chief executive, Trust 4 ]. 


Two years on I still believe in the concept, um, because I think the biggest single problem we have is 
sharing information between organisations and actually even within organisations, so the idea of having a 
single system or common systems as an IT concept only makes sense. [Director of IM & T, Trust 4]. 


The consequences are, um, a complete re-think about the way that, um, IT is introduced and it’s needed 
it desperately ... NHS IT programme is visionary, brilliant . . . [Director of IM & T, Trust 2]. 


Box 2: More product placement and benefits realisation 


We have to get some confidence back into the programme and that has to be about delivery because they 
can talk until the cows come home, but unless we see something happening on our own patch with a real 
clinical win to keep people onboard . . . [Director of IM & T, Trust 4]. 


I think one of the things that they haven’t done very well is clarify some of the benefits they think that 
you're going to get out of it... . I] haven’t seen, you know, a good list of benefits. . . I mean, you know, about 
between GPs and consultants, I mean actually things like managing a waiting list. [Director of performance 
and improvement of information, Trust 1]. 


I think the . . . two big difficulties, the two big issues will be affordability, is it really going to deliver the 
benefits, um, for the cost and is it, is it a cost pressure rather than an enabler of better efficiency across the 
organisation as a whole?. . . we are dependent on getting benefits out of it... .and I’m not confident at this 
stage this stage that the system in operation will be so beneficial that it will really drive loads of things 
forward. [Chief executive, Trust 3]. 


Box 3: Expensive solutions especially PACS implementation 


A lot of the things are being sold to us at a much higher price than we would have been able to get if we’d 
been in a real market situation, so the total costs to the NHS have been very high indeed. [Medical director, 
Trust 4]. 


You know, we went out to procure a PACS system that was not part of the national programme, and, 
you know, got told we couldn’t do it. That’s resulted in more, a lot more expenditure for the trust than the 
local solution, so I think that then heaps another layer of problems on . . . where we have a deficit, um, to 
be forced down a route that’s more expensive without . . . financial support that really we should be getting 
about that, you know, it’s just another disincentive really. [Chief executive, Trust 2]. 


... it’s certainly extensive costs, um, and it’s compulsory acquisition, we have to have it in by March, 
that’s it. So, it’s, it’s just a cost pressure, it’s another, another one of many cost pressures at the trust. [Head 


of system delivery, Trust 1]. 


Box 4: Managers distracted from implementing the NHS IT programme by other priorities 


Actually motivating people in this particular trust at this particular time to have the vision to get involved 
in a nation-wide project, which isn’t delivery, is virtually impossible. The majority of my colleagues are 
surviving day to day with no beds, cuts . . . There are real immediate issues, there isn’t the, um, the luxury, 
I suppose, of people having the time and the intellectual capacity to pursue a ten year vision. We try to, we're 
trying to survive. [Medical director, Trust 2]. 


I would like to see good IT systems within the NHS . . . where I’m coming from ina trust that’s got the 
Performance Support Team in and we’ve got the Turnaround Team in, um, we are trying to pull out a great 
deal of expenditure about ten percent of our budget . . . it does feel a little unreal trying to implement a large 
IT system on top of that . . . there’s no real plans yet because we haven't got that far. And, to be honest, the 
whole other agenda [making savings] is just taking my time up. [Director of nursing, Trust 1]. 
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Box 5: Continued uncertainty and feeling of disempowerment 


The frustration is we’re not the customers, as far as the suppliers are concerned . . .. CfH pull the strings, 
it’s their contract, we’re just the entity that takes the solution. [Director of IM & T, Trust 2]. 


The communication has been bloody awful really ... we’ve kind of been the recipients of those 
relationships as opposed to being directly as influential as we would like to be in those relationships. I’m 
saying is every two months we say “Where’s my pathology system?” “Oh, well, we’ve got to finish this. . .” 
so you kind of tune out, that’s how it has felt, you’ve felt a little bit I guess disempowered really, um, because, 
you don’t have the internal levers to actually, most problems I’ve got I can sort out a lot, but I feel it’s not 
within my power to sort them out. [Chief executive Trust 4 ]. 


_. . 80 ourselves kind of at the bottom of the food chain we just, we don’t get involved in any of this and 
it has been two-and-a-half years, it seems to be solid negotiation and re-negotiation between NHS IT 
programme and BT. [Director of IM & T, Trust 4]. 


Box 6: Lack of clinician engagement 


I’m not driving the national programme forward at all . . .. We’re not doing any enabling at all as far as 
that process is concerned. I’m definitely not going to do what some of my colleagues have and that’s work 
on the basis that they were getting their slots and have ended up with staff employed, ready to go and nothing 
to go with. [Director of IM & T, Trust 2]. 


... We’ve actively discouraged it here [engagement], which is a strange thing to do, in a way, but because 
we didn’t want to raise expectations ... there is no software backing that up at the moment, or not that 
we’ve seen .. . I don’t encourage our clinicians to get involved on the demonstration days. [Director of IM 
& T, Trust 4]. 


I wouldn’t go out and sell it to people because I don’t know when it’s going to arrive. . . . getting people 
too enthusiastic on specific timescales would have been very dangerous. [Chief executive, Trust 4 ]. 


I think the biggest problem we’ve had, as an organisation, is, um, you have to have a product to sell to 
the clinical staff to get them enthused, to get them to use it, and the biggest problem we’ve had is that the 
product has not revealed itself to us yet. [Medical director, Trust 3]. 


Box 7 Continued delays and re-planning 


... the dates keep getting re-planned because we’re not allowed to say delayed anymore we joke in this 
trust that NHS IT programme is never closer than two years away and just when you think it’s actually going 
to be closer it suddenly goes . . .. again and it’s two years away again. [Systems training manager, Trust 3]. 


I see all the sort of stuff, the propaganda that comes out from CfH and they’re always saying how a lot 
of these things are actually on time, despite what the press says, um, hundreds of people are using the new 
systems and all that sort of, and I must say, you know, there’s not an awful lot of evidence of that across 
the country, I don’t think. [Clinician lead for CfH, Trust 2]. 


They obviously, they know that the CRS isn’t going to deliver in a sort timely manner, so they’re kind of 
looking at this other product to work with existing PASs. [Assist. director of IM & T, Trust 4]. 


So we’ve got these tactical solutions coming in and that helps because we’re seen to be moving forward. 
My only problem with tactical solutions is that in a few year’s time one expects that tactical solutions to be 
replaced with whatever IDX is going to demand and I don’t know that I really want to put my trust through 
implementing a tactical PAS and then doing it again. [Director of IM & T, Trust 2]. 


Box 8: Concern over growing risk to patient safety, some trust may go it alone 


... Our path system is extremely out of date, it’s not just obsolescent, it’s obsolete. When we had to buy 
some new bits for it recently we had to buy them through Ebay from someone in America because there’s 
just no bits in this country, so it’s a huge risk to the trust that we’re still carrying this path system. . . [Medical 
director, Trust 4]. 


It’s been urgent that it’s replaced all the time I’ve been here, which is about three-and-a-half years, so I 
mean the first thing I heard about when I arrived was the fact that the PAS system needed to be replaced. 
It is a clinical risk. [Director of nursing, Trust 1]. 


_ And there are a number of risks that are associated with our old system, some very serious risks and risks 
in development and progress within the organisation and between the organisations due to this lack of 
putting a good idea into practice. [Divisional manager for diagnostic therapies and outpatients, Trust 4]. 


... that’s a risk we, that is a risk. I mean it could, you know, die tomorrow, it’s such an old system and 
then we are really stuffed, basically. [Director of nursing, Trust 2]. 


The Electronic Patient Record: Evidence Ev 141 


ee ee ae ee a ee We ee ee ee eee eS 


People are saying “Thank God we’re going to get a new system that will replace this load of old, you know, 
cobblers.” ... Americans use the expression “You need a burning platform to get change”. Well, I think 
from an IT perspective we’ve probably got one. [Director of IM & T, Trust 2] 


One of the options I have is to say “To hell with it, I’ll just go and buy one”. Well, that’s a kind of tricky 
decision and that’s the decision some of my peers are making elsewhere, they’re saying “Well, sod that, I’ll 
go elsewhere”. [Divisional manager for diagnostic therapies and outpatients, Trust 4]. 


Box 9: Loss of integration of components of the NHS IT programme [0] 


I think it is back-peddling big time because I don’t think the, right now they’re in a position to deliver 
that original vision and so even things like the PACS was going to be an NHS-wide archive and then it was 
going to be a cluster archive and now they’re just talking about having a trust archive. [Director of IM & 
T, Trust 4]. 


I’m just worried that the ideas are actually drifting away from the way that initial strategy, from the way 
the trust is working, whereas at one time you kind of offered a nice way forward I’m worried it’s kind of 
diverging . . . [Divisional manager for diagnostic therapies and outpatients, Trust 4]. 


One of the things that’s become apparent is that the original vision of a shared record between primary 
and secondary care is not at the moment on the, on the design, aim and design . . ..what they’re looking to 
do is to use messaging systems between primary and secondary care, so effectively you’ll have electronic 
letters and discharge summaries and those sorts of reports .. . and the spine won’t, the spine is currently 
going to be quite thin, so it’s not going to be data rich. [Clinician lead for CfH, Trust 2]. 


... we’ve got foundation trusts, we’ve got perhaps more importantly the mixed economy so, um, are we 
saying that a condition of a private provider receiving NHS work is that they have to be signed up to the 
national programme? . .. we’re not going to have a national solution that actually is fit for purpose in a 
mixed economy and providers. [Chief executive, Trust 2]. 


I genuinely am not sure whether the solutions are solutions to yesterday’s analysis rather than today’s 
analysis. . .. 1 think what’s happened over the last few years is we have moved from NHS PLC to healthcare, 
as an industry, which has lots of different players in it. [Chief executive, Trust 3]. 


Box 10: Discontent with Choose & Book & loss of confidence in the programme 


I’ve not really talked to the clinicians about, about whether they think it’s a good idea or not [Care 
Records Service]. They certainly think choose, choose and book is a crap idea, they hate it . . . [Director of 
performance and improvement of information, Trust 1]. 


... we'll call it choose and book because it helps with politics. The software is not fit for purpose. ... We 
have an unstable middle-ware server because the spine keeps vanishing ... what happens is the 
synchronisation messages from them to the other doesn’t happen, things get lost, so you end up with patients 
booked, but we don’t know about them. We’re getting a 53, sorry 57% error rate at the moment. [Director 
of IM & T, Trust 2]. 


Technically I’m not sure that they can deliver it at the moment. I don’t think they’re, I don’t think they 
have the architecture in place to actually deliver it on a national scale, let alone, actually even a cluster scale, 
to be honest, so I think they are struggling with it. [Director of IM & T, Trust 4]. 


... somebody, not here, but at the PCT level is trying to increase that all the time [usage by GPs] .. . I 
know that some GPs absolutely hate it and I get the impression that they’re using it under duress and that 
the slightest fault is a case of “Well, what a rubbish system, would never work anyway.” [Chief executive 


Trust 4]. 


_.. if it doesn’t start delivering soon people will begin to say it can’t deliver . . . they, um, they just feel 
resentment or that it’s irrelevant or, worse still, it looks like money poured down the drain while they’re 
having to make staff redundant . . . then there will gradually be a sort of almost a “We’re going to make sure 
it doesn’t work“” mentality coming. [Chief executive, Trust 4]. 


Professor Naomi Fulop : 
School of Social Science and Public Policy 
King’s College, London 


30 May 2007 
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Further supplementary evidence submitted by the Department of Health (EPR 01D) 


Questions were raised during the 14 June 2007 hearing about whether evidence existed for the levels of 
service availability provided by suppliers under the National Programme, and about the level of resilience 
provided to withstand significant system failure, and to maintain service to the end user. 


I undertook to provide a note, specifically on details of the latter. I have had the attached note prepared, 
which I believe fully covers both these issues. 


Note ON NPFIT SERVICE AVAILABILITY AND RESILIENCE 


1. System Availability 


Q629 Mr Campbell: . . . “we have been told that when clinical records are remotely hosted, the loss of the 
hosting centre or the network for more than a few minutes could lead to loss of life. So both the hosting and 
the network need to be available virtually all of the time. Is there any evidence of this?” 


The systems provided by CFH are monitored and maintained by the relevant suppliers 24 hours a day 7 
days a week to ensure that any incident is detected and the appropriate measures are taken to ensure all 
services are available to the end users. 


Service availability statistics can be viewed on the Connecting for Health public facing web site 
www.connectingforhealth.nhs.uk. The Statistics section within the Newsroom tab provides information on 
service availability and service level achievements for National Application Services ( Choose&Book, N3, 
NHS Care Records Service (NCRS), Connecting For Health (CFH) Service Desk, NHSmail ) and Local 
Service Provider (LSP) application services (eg. Picture Archiving & Communications Systems (PACS 
Digital Imaging) Radiology Information Systems (RIS), Patient Administration Systems (PAS) etc). 


This briefing summarises the levels of system availability and the performance against agreed system 
availability targets (Service Level Agreements—SLAs) with each supplier. 


In line with normal industrial practice, where incidents do occur these are classified according to their 
impact on the business and the users and are classified as follows: 


Severity 1: 


A Severity 1 service failure is a failure which, in the reasonable opinion of NHS Connecting for Health, 
the contractor, or a National Health Service system/service user has the potential to: 


— have a significant adverse impact on the provision of the service to a large number of users; or 
— have a significant adverse impact on the delivery of patient care to a large number of patients; or 
— cause significant financial loss and/or disruption to NHS Connecting for Health, or the NHS; or 


— result in any material loss or corruption of health data, or in the provision of incorrect data to an 
end user. 


Severity 2: 


A Severity 2 service failure is a failure which, in the reasonable opinion of NHS Connecting for Health, 
the contractor, or a National Health Service system/service user has the potential to have a significant 
adverse impact on the provision of the service to a small or moderate number of service users; or 


— have a moderate adverse impact on the delivery of patient care to a significant number of service 
users; or 


— havea significant adverse impact on the delivery of patient care to a small or moderate number of 
patients; or 


— have a moderate adverse impact on the delivery of patient care to a high number of patients; or 


— cause a financial loss and/or disruption to NHS Connecting for Health, or the NHS which is more 
than trivial but less severe than the significant financial loss described in the definition of a Severity 
1 service failure. 


The following tables show concurrent, registered users and service availability statistics for all National 
and Local Programmes for IT. 
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CONCURRENT USERS AND SERVICE AVAILABILITY STATISTICS—24x7 


a SE RS aI Ga RRL URE WS hi RR aerial tei nints ett i hin tev ata kl Sa ile 
Electronic SPINE 


Choose Prescription (excluding 
National systems N3 QMAS  NHSmall — and Book Service EPS) 
Potential uptime in user mins 470,807.2  2.220.0 57,799.0 2.168.0 2,840.0 64.339.0 
Actual uptime in user mins 470,799.8 2.220.0 57,798.2 2.166.3 3.839.7 64,336.5 
Lost user mins 7.4 0.0 0.8 1.7 0.3 2.5 
No of users 975,000 4.119 118,223 6.337 7.866 149,453 
Availability achieved for 1 year 99,998% 100,000% 99.999% 99.924% 99.990% 99.997% 
Availability Target 99.99% 99.99% 99.99% 99.50% 99.90% 99.90% 
Lost user minutes per user per year 7.6 0 8 263 106 8.2 
Lost user minutes per user per month 0.6 0.0 0.6 21.9 8.8 6.9 


—— 
SS 


GP 

(Primary 

Service Type PAS Theatres Care/ 
(excluding (excluding Decision 

PACS PAS Maidstone) Theatres Maidstone) Ambulance support) 

Potential uptime in user mins 2,623.6 5.031.8 5.031.8 188.5 188.5 221.3 4.011.1 
Actual uptime in user mins 2,622.7 5.026.5 5.030.2 186.7 188.2 221.3 4.011.0 
Lost user mins 0.9 a 1.6 1.8 0.3 0.00 0.04 
No of users 6,846 13,361 13.361 424 332 496 9.064 
Availability achieved for 1 year 99.964% 99.844% 99,962% 98.919% 99.832%  100.000%  99.999% 
Availability Target 99.87% 99.90% 99.90% 95.00% 95.00 99.30% 99.20% 
Lost user minutes per user per year 137 394 120 4.361 739 0 4 
Lost user minutes per user per month 11.4 32.9 10.0 363.4 62.0 0.0 0.4 





CONCURRENT USER AND SERVICE AVAILABILITY STATISTICS-—SER VICE HOURS 


Electronic SPINE 








Choose Prescription (excluding 

National systems N3 QMAS  NHSmall — and Book Service EPS) 
Potential uptime in user mins 196.170.0 925.0 24.083.0 903.0 1,600.0 26.808.0 
Actual uptime in user mins 196.167.0 925.0 24.082.4 901.8 1.599.9 26,806/1 
Lost user mins 3.0 0 0.6 1.2 0.1 1.9 
No of users 520.000 4.119 118.223 6.337 6,866 149.453 
Availability achieved for | year 99.997%  100.000% 99.997% 99.864% 99.982% 99.994% 
Availability Target 99.99% 99.99% 99.99% 99.50% 99.90% 99.90% 
Lost user minutes per user per year Dak 0 5 197 227 13 
Lost user minutes per user per month 0.4 0.0 0.4 16.4 18.9 1.1 
GP 

(Primary 

Service Type PAS Theatres Care/ 
(excluding (excluding Decision 

PACS PAS Maidstone) Theatres Maidstone) Ambulance support) 

Potential uptime in user mins 2,623.6 5,031.8 5,031.8 188.5 188.5 221.3 4,011.1 
Actual uptime in user mins 2.622.11 42:020.5 5,030.2 186.7 188.2 221.3 4,011.0 
Lost user mins 0.9 523 1.6 1.8 0.3 0.00 0.04 
No of users 6.846 13,361 13,361 424 332 496 9.064 
Availability achieved for | year 99.964% 99.884% 99.962% 98,919% 99.832% 100.000% 99.999% 
Availability Target 99.87% 99.90% 99.90% 95.00% 95.00% 99.30 99.20% 


i 
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REGISTERED USERS AND SERVICE AVAILABILITY STATISTICS—24x7 


er 


National systems 





Potential uptime in user mins 
Actual uptime in user mins 

Lost user mins 

No of users 

Availability achieved for 1 year 
Lost user minutes per user per year 
Availability Target 

Lost user minutes per user per year 
Lost user minutes per user per month 


Service Type 


SPINE 
(excluding 
EPS) 


144,772.5 
144.760. 1 
12.4 
297.158 
99.9920% 
99.90% 

6 

0.5 


GP 
(Primary 
Care/ 
Decision 


Electronic 
Choose Prescription 
N3 QMAS NHSmall and Book Service 
627,743.0 18,469.4 = 123,335.5 40.587.3 25,548.1 
627,733.1 18,469.4  123.333.7 40.585.6 25,547.1 
9.9 0 1.8 LJ 1.0 
1,300,000 34,323 253.994 87,400 52,440 
99.998%  100.000%  99.9985%  99.9957% 99.9959% 
99.99% 99.99% 99.99% 99.50% 99.90% 
14.0 0 - 20 32 
0.9 0.0 0.6 iy 2.6 
Sam Naa A Ra RE Ps SVE PE nA ATR Rati Ni RABE 2A i AIRE oat Loe pee ee 
Ss A ae ce ee I ei ai uke 2 as PNM A soa ek ALK etn Ba rnemne ats haan ees tne ten 
PAS Theatres 
(excluding (excluding 
PACS PAS Maidstone) Theatres Maidstone) Ambulance 


support) 








Potential uptime in user mins 3,272.2 29,798.5 29,798.5 1,916.7 1,917.0 1,641.4 3,877,409.2 
Actual uptime in user mins 3,271.2 29,788.8  29,788.8 1,907.2 1,916.6 1,641.4 3,877,381.4 
Lost user mins 1.0 9.7 9.7 9.5 0.4 0.0 27.8 
No of users 6,163 69,552 69,552 4.198 3,081 3,742 8,982,307 
Availability achieved for 1 year 99.968% 99.965% 99.965% 99.455% 99.975% 100,000% 99.999% 
Availability Target 99.87% 99.90% 99.90% 95.00% 95.00% 99.30% 99.20% 
Lost user minutes per user per year 166 139 139 2,260 105 0 3 
Lost user minutes per user per month 13.9 11.6 12.0 188.4 9.0 0.0 0.3 
REGISTERED USERS AND SERVICE AVAILABILITY STATISTICS—SER VICE HOURS 
Electronic SPINE 
Choose Prescription (excluding 
National systems N3 QMAS NHSmall — and Book Service EPS) 
Potential uptime in user mins 261,559.6 51,389.8 51,389.8 16,911.0 10,645.0 60,322.0 
Actual uptime in user mins 261,552.2 51,389.8 51,388.5 16,909.7 10,644.3 60,312.7 
Lost user mins 7.4 0.0 1.3 1.3 0.7 2.3 
No of users 1,300,000 34,323 253,994 87,400 52,440 297,158 
Availability achieved for 1 year 99.997% 100,0000%  99,9974%  99.9923% 99,9821%  99,9856% 
Availability Target 99.99% 99.99% 99.99% 99.50% 99.90% 99.90% 
Lost user minutes per user per year 8.0 0 2 15 24 31 
Lost user minutes per user per month 0.7 0.0 0.1 132 1.6 2.6 
GP 
(Primary 
Service Type PAS Theatres Care/ 
(excluding (excluding Decision 
PACS PAS Maidstone) Theatres Maidstone) Ambulance support) 
Potential uptime in user mins 1,363.4 12,416.1 12,416.1 698.6 799.0 683.9 1,615,587.2 
Actual uptime in user mins 1,362.6 12,408.8  12,408.8 791.5 798.7 683.9 1,615,566.4 
Lost user mins 0.8 fies dad 7.1 0.3 0.0 20.8 
No of users 6,163 69,552 69.552 4.198 3,081 3,742 8,982,307 
Availability achieved for 1 year 99,943% 99.937% 99.936% 99,019% 99.955% 100.000% 99.999% 
Availability Target 99.87% 99.90% 99.90% 95.00% 95.00% 99.30% 99.20% 
Lost user minutes per user per year 166 139 105 2,260 79 0 3 
Lost user minutes per user per month 13.9 11.6 9.0 188.4 7.0 0.0 0.3 
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2. System Resilience 


Q636 Chairman: Do you have a comparator in terms of databases in the UK? I know there are different 
levels of resilience that evolve but what is the comparator with the one you are implementing for the national 
patient record? 


Mr Granger: We asked CIOs and frontline clinicians in the NHS during the specification process what 
levels of resilience did they want and they had some degree of tolerance for planning downtime, and I can 
let you have a note on the details of this, and a low degree of tolerance for unplanned downtime. 


Suppliers provide services from data centres, where IT systems are built to withstand significant levels of 
failure, and maintain service to the end user. 


Suppliers have built primary and secondary facilities at different sites to provide a back up in the event 
of a highly unlikely failure affecting a whole site. Within these data centres there are multiple levels of 
resilience, to withstand more localised failures. In other words, the data centre suppliers ensure they do not 
have any “single points of Failure”, where one piece of IT equipment will exist without a back up, or a 
resilient partner. Often the additional resilience is also provided to improve performance by increasing the 
capability of each piece of IT equipment, and hence the overall system or service. The data centres are 
monitored 24x7 to ensure failures are identified and fixed prior to them having an impact on end user service. 
Data is stored securely over multiple sites, to ensure in the event of failure that no data is lost. 


Additional information is also provided on: 
— The CSC quad data centre strategy in response to the service outage in 2006. 


— National Application Service Provider (NASP) and Local Service Provider (LSP) data centre 
architecture and testing. 


— Details of network switch and circuit resilience. 


CSC QuaD Data CENTRE STRATEGY 


NHS Connecting for Health commissioned an independent review of the service outages in 2006 which 
helped to identify areas where the service provision could be further improved. Key to business continuity 
in these areas is the ability to failover one system to another data centre independently of any other service 
that is being hosted and with which it may interact. 


With CSC taking over services that were being provided by Accenture in the North and East, CSC are 
building two new data centres to replace those that were being used. These new data centres will be 
operational this year and will embody the principles of independent failover that were highlighted in the 
review. CSC is undertaking a reworking of the architecture of the transitioned services to ensure that they 
will meet the high standards. 


The new data centres have been constructed within 50 kilometres of the existing CSC/NHS sites, but at 
a sufficient distance to ensure that no large scale incident could impact more than once. This proximity 
allows the four data centres to be used eventually to support four way failover, with three sites available for 
Disaster Recovery. The locations also allow for a “metropolitan” high speed network to be implemented 
that will allow the failover of N3 connectivity and data storage services, providing further levels of resilience. 
The high level architecture diagram, Figure 1, shows the logical relationship between all four data centres. 
The infrastructure element relationships supporting continuity of service are illustrated by the bi- 
directional arrows. 
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NASP AnD LSP DaTA CENTRE ARCHITECTURE AND TESTING 


The BT Spine architecture typifies the approach across NASP and LSP suppliers. The Spine service is 
provided from two data centres known as Live A, and Live B. They are secure and resilient, being located 
and built in such a manner to minimise any potential disruption to service. They are classed as List X sites. 
A List X site is a commercial (non-government) site on UK soil, that is approved to hold UK Government 
protectively marked information (Confidential and above). The approval is in the form of formal 
accreditation by the Communications Electronic Security Group (CESG), the Information Assurance arm 
of Government Communications Headquarters (GCHQ). Because companies with this status are those 
normally involved with Defence research and manufacturing that is vital to national security, the details of 
how resilient List X data centres are is restricted information. However, the sites are formally and regularly 
audited both at Government and Customer level and offer service levels far in advance of non-List X sites. 


The target to resolve a severity one incident is less than 2 hours. The severity one fix time target is linked 
to the target time to recover the service. Whereby if BT Spine were to experience a serious failure at one of 
the sites, which could mean service was going to be disrupted for an extended period if no action was taken, 
BT Spine would complete a failover to the unaffected site. This capability is regularly tested. In reality, 
service is resumed much more quickly than the target of 2 hours. 


BT Spine meets the requirements laid out to them by NHS CFH and has completed regular successful 
tests. This major disaster recovery failover testing is completed by suppliers at a minimum of every 12 
months, with some tests scheduled every 6 months. Between these times, suppliers also complete other tests, 
such as process walkthrough, configuration audits and resilience tests to ensure they are prepared and ready 
in the event of a live operational requirement to complete a failover. 


In terms of the resilience within a data centre site, there is a significant level of testing prior to deployment 
to ensure the IT equipment performs as it was designed. Once implemented, the IT equipment is monitored 
24x7 to identify any potential failures or issues, which, if not resolved, would cause failure. 


In addition, the resilience is monitored to identify when it is invoked automatically, ie if a database fails 
and a resilient partner maintains live service, this will be tracked and the outcomes recorded as a means of 
testing the resilience on an on-going basis. 
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DETAILS OF NETWORK SWITCH AND CIRCUIT RESILIENCE 


Resilience is provided in the network by the deployment of primary and secondary circuits and switches 
to maintain continuity of service. The level of resilience within the N3 network is based upon a combination 
of N3 specific elements and components of Disaster Recovery Service provided by the suppliers to N3 
Service Provider including BT. The Network, which has been deployed, is based on Points of Presence 
(PoPs) and these PoPs are designed to facilitate the contractual requirement to be able to connect resiliently 
all access catalogue services into the N3 Core. The PoPs are designed to support connections from primary 
and secondary circuits from N3 Customer sites. In addition to N3 access circuits being resiliently connected 
into the N3 core, the core itself and all key infrastructure components that operate upon the network core 
(eg Internet Gateway, Domain Name Sever (DNS) and infrastructure for other N3 Foundation Services) 
have been built to a specification that are resilient in design. Taking this into consideration, business 
recovery strategies are in place for all standard elements of the network and strict SLAs are in place to ensure 
that N3SP restores service and original configuration of those services within the shortest possible time, 
should services be interrupted. Business Recovery Plans are also in place for other supporting service 
elements delivered by N3. 


Richard Granger 
Department of Health 


5 July 2007 


Further Supplementary evidence submitted by the Department of Health (EPR 01E) 


Note from Department of Health to the House of Commons Health Select Committee commenting on 
the evidence provided by various witnesses. 


1. The Health Select Committee is conducting an enquiry into the NHS electronic patient record, which 
is the cornerstone of the NHS National Programme for IT (the Programme). The Department of Health 
submitted written evidence in March 2007 and again on 12 June 2007. Departmental officials also gave oral 
evidence on 26 April 2007 and, with the then Minister of State Lord Hunt, on Thursday 14 June 2007. 


2. The Committee has also taken or received evidence from a wide range of other witnesses. It is noted 
that this evidence contains a number of inaccuracies and a number of flawed conclusions. It is also clear that 
there has been some collaboration between witnesses who have made the same point without any supporting 
evidence whatsoever. To assist the Committee in reaching conclusions, this note comments on that evidence. 


3. Where appropriate, specific witness statements are cited or reference is made to the relevant paragraph 
numbers from the transcripts of the oral hearings. 


4. The comments are divided into the following sections: 

Data standards, IT system security, system performance and general IT issues. 
Timing and delays. 

Local NHS costs and affordability. 

The summary care record and patient confidentiality. 

Consultation and professional engagement on the system specification. 


aw ae 


Evaluation and benefits. 
Public information and patient safety. 


oS SS ee 


Other issues. 


SECTION 1: DATA STANDARDS AND INTEROPERABILITY, IT SYSTEM SECURITY, IT SERVICES AND GENERAL 
PROGRAMME RELATED IT ISSUES 


Section 1.1: Jssues Relating to Data Standards and Interoperability 


Data standards 
5. A number of witnesses raised issues relating to the adoption of common standards: 


5.1 In EPR 29 the UK Computing Research Committee says (at paragraph 25) that: 


“ many of the technologies are new and have not been tested. In particular, at the heart of the 
EPR are two standards—HL7 v3 and SNOMED-CT. We understand that neither has ever been 
implemented anywhere on a large scale on their own, let alone together. Both have been criticised 
as seriously flawed. It is imprudent to base the Electronic Patient Record, which will be part of the 
UK’s national critical infrastructure, on a technology experiment.” 
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5.2 This statement needs to be read in context. Currently the formally approved European (CEN TC251) 
and International (ISO 215) Standards’ Bodies in health informatics do not require standards to be tested 
formally before approval. As many of the UK computing research community contribute to them, it is 
hoped they can improve the current situation, which is not peculiar to the National Programme but is a 
global issue. It is surprising that the UK Computer Research Committee has not acknowledged the 
substance and extent of the standards being used within the National Programme for IT, and particularly 
the prevalence and authenticity of SNOMED-CT and HL7v3. 


5.3 At the heart of the National Programme is a range of standards that are both international and 
national. Many of these standards are pan-government like the e-government interoperability framework 
(e-GIF) and many have a long history (for example the Data Dictionary data standards, which arose from 
the Korner Report in 1981!%). There are a range of special standards in the Electronic Patient Record which 
involve information governance and “health record and communication practice standards” which by 
definition are relatively new and rapidly emerging technologies. 


5.4 SNOMED.-CT is the most widely used, most comprehensive, and most extensively tested clinical 
terminology in the world. It builds upon the successful use of its component Read Codes (1983) in the UK 
and the successful use of its component SNOMED codes (since 1965) in a variety of settings worldwide. For 
example Kaiser Permanente is a fully integrated health-care delivery system in the United States that cares 
for 8.5 million people. Kaiser Permanente HealthConnect is their electronic health record and information 
system. Deployment began in 2003 and is now almost complete, with over 13,000 physicians and 150,000 
staff using it for nearly all daily duties and more than two million of their members logging-on to use their 
health data (with more every day). SNOMED-CT is also a foundational element of secondary data use for 
research and health services’ planning in Kaiser Permanente. It is one of the critical factors in helping them 
produce value from the system by measuring and improving health. 


5.5 The most important characteristic of a coding system for clinical care is comprehensiveness, that is, 
the ability to provide a coding solution for the vast breadth of health care. In independent evaluations of 
content coverage, SNOMED-CT is uniformly found to be the most comprehensive of all extant clinical 
coding systems, usually by a fairly large margin. SNOMED-CT is now owned by nine countries globally 
through an open International Health Terminology Standards Development Organisation based in 
Denmark. They have made quality improvement at the heart of its operation so SNOMED CT will become 
even better to meet the needs of clinicians and citizens worldwide. 


5.6 Within health informatics HL7 is the international standard for messaging. HL7 V2 is a widely 
adopted standard within the NHS and V3 updates that standard using XML formats for interchange (KML 
is the underpinning formatting standard for modern internet communications). 


5.7 HL7 V3 allows for rich interchange of clinical information, embedding modern clinical terminologies 
such as SNOMED.-CT. HL7 is supported by a wide international community, with working group meetings 
three times a year. In particular, the Programme is using Clinical Document Architecture (CDA) for key 
parts of the Summary Care Record, which allows for blending of rich semantic information using 
SNOMED-CT with textual clinical information. CDA is a key HL7 V3 standard that is being widely 
adopted internationally. 


5.8 The National Programme is leading the way in the implementation of interoperable healthcare 
solutions. Hence, we are implementing requirements which stretch the international standards. Where 
standards are found lacking for our use we endeavour to incorporate our work back into the international 
standard, taking a leadership role where possible. 


5.9 We have engaged with HL7 in a number of ways, through the co-chairs appointed to key committees. 
We have initiated a number of projects in this arena for the benefit of the National Programme and the wider 
supplier community. Current ones include message format improvements (known as an Implementation 
Technology Specification or ITS) and clinical content modelling (known as HL7 Templates). 


5.10 The standards arena is developing for clinical communications. HL7 V3 is a leading standard, and 
is working towards harmonisation with other standards such as CEN13606. We are monitoring these 
standards, and working with the standards’ organisations, to ensure that our messaging strategy is reflected 
in the development of those standards. 


5.11 HL7 has a working group known as TermInfo that provides standard guidelines on the embedding 
of terminologies in HL7 messages. In addition, NHS Connecting for Health’s message development team 
provides a variety of additional and detailed constraints on the use of SNOMED-CT inside messages, 
distributed to suppliers in the Message Implementation Manual (MIM). This ensures a consistent and 
interoperable exchange of coded clinical information. 


5.12 In case Dr Thomas’ comments (Q108) should be interpreted as casting doubt on the matter, NHS 
Connecting for Health has ensured that the many systems and services that have been delivered, and 
continue to be delivered, through the Programme are compliant with HL7 version 3 and the Dicom digital 
imaging international standards. NHS Connecting for Health is, in fact, the global leader in the 
implementation of HL7 V3 messaging and is also the host organisation of the International Health 
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'3 First Report of the Steering Group on Health Services Information (The Korner Report), HMSO, London. 
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Terminology Standards Development Organisation National Release Centre in the UK, which will provide 
a central point for managing, distributing, supporting and controlling the use of SNOMED-CT terminology 
and related assets throughout the UK. Adoption of these standards will ensure interoperability, so that 
confidential patient information will be more readily and securely transferable across the NHS. 


5.13 It is noted that a number of members of the UK Computer Research Committee have contributed 
to evidence from other sources. In particular, Professor Randell and Dr Thomas, along with Ross Anderson, 
are among the 23 academics who called for an independent review of the National Programme. 


System interoperability 


5.14 It would be helpful to expand on some of the evidence on system interoperability. There have been 
a number of assurance / accreditation / compliance schemes for existing systems’ providers in the NHS. 
including the Requirements for Accreditation (RFA) scheme commonly referred to as RFA99. 


5.15 RFA99 was a technical aid for suppliers to develop systems for testing and accreditation. It was also 
used by Health Authorities and purchasers of GP systems in providing guaranteed levels of functionality. 
It included an accreditation process that focussed on a set of test scripts. 


5.16 The Common Assurance Process (CAP) is the replacement for all of the existing schemes. RFA99 
requirements have been superseded by the CAP-GP Core Requirements, which have been updated to 
include the Programme’s standards and policies, including the use of the international standard HL7V3 and 
the N3 network. 


5.17 CAP-GP supports the GP Systems of Choice (GPSoC) programme. GPSoC provides six levels of 
system compliance, each of which provides increased functionality in line with the strategic objectives of the 
National Programme. Each level comprises a detailed set of requirements and standards that a supplier must 
meet. These include the interoperability requirements defined in the Message Implementation Manual using 
HL7V3, including the use of the Personal Demographics Service, Choose and Book, Electronic 
Prescriptions and GP2GP messages. This approach is driving interoperability across the GP-provider 
environment. 


NHS number as the unique identifier 
5.18 The evidence relating to the use of the NHS number (Q617) would aiso benefit from expansion. 


5.19 The work on the NHS number in the 1990s provided a set of basic enabling tools, such as the NHS 
Tracing Service. However, there were initially few incentives for the NHS to use the number, mainly because 
the concentration was on systems within individual organisations. After the NHS Plan was published in 
2000, it became increasingly clear that this work was not sufficient, and three major steps were taken: 


— the commissioning of the NHS Numbers for Babies Programme; 
— the investigation of groups of individuals without NHS numbers (eg service personnel); 
— reviewing the mechanisms to encourage NHS organisations to use the NHS number. 


5.20 The Building the Information Core statement in 2001 outlined targets for trusts to use the NHS 
number in communications such as requests for tests and results. 


5.21 The National Programme then considered recommendations from the Information Standards 
Board (ISB) that the NHS number should be adopted as a key identifier for use by the Programme’s systems 
and by associated existing IT systems that do or will interface with those of the Programme. Whilst the 
benefits of using the NHS number were recognised, the issues for organisations migrating from local 
numbers and the consequential need for the transition to be managed carefully, were also recognised. The 
Programme accepted the recommendations and asked that the ISB adopt the NHS number asa fundamental 
national standard as soon as possible. However, given the recognition that the work involved in adopting 
the NHS number was not a trivial task, it was agreed that a project-based, incremental, approach should 
be adopted to undertake the co-ordination, communication, steering and issue resolution that would be 


required. 


5.22 The establishing of the National Programme provided the opportunity to rationalise the 
demographics systems in use across the NHS to provide an operational, up-to-date record (the Personal 
Demographics Service (PDS)) which could be accessed by authorised users across the country. This was 
critical to ensuring the delivery of care records which were intended for individual patients, rather than for 
separate institutions. The Personal Demographics Service (PDS) is an essential element of the NHS Care 
Records Service, underpinning the creation of an electronic care record for every registered NHS patient in 
England. It serves as a gateway to the clinical record, enabling authorised healthcare professionals to locate 
quickly the clinical record that is uniquely associated with each demographic record. — 

Unlike the previous services, this single authoritative source of demographics is accessible throughout the 
NHS and is integrated fully with the other applications and services delivered as part of the National 
Programme for IT. These include Choose and Book, Electronic Prescription Service (EPS), GP to GP and 
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HealthSpace. It provides more convenience for patients as they need only notify one authorised healthcare 
organisation of a change of address and this change will be available to all healthcare organisations as and 
when the patient records are accessed. 


5.23 Progress made with the PDS since the NHS numbers programme includes: 


— Integration with LSP Systems—Local Service Provider systems integrate with the PDS to allow 
nationally held patient demographics to be used at the point of care. This means that it is possible 
to use the NHS number reliably as soon as the patients presents themselves. 


— Immediate Birth Notifications to PDS—the NHS Numbers for Babies System (NN4B) issues NHS 
numbers on new births. From 1 June 2006, a link between NN4B and the PDS made information 
on new births available immediately in the NHS Care Record Service. As a result, 93% of babies 
are now allocated an NHS number within 12 hours of being born. Prior to this, it could take up 
to eight weeks for a baby’s demographic information to be available to the NHS outside the unit 
in which the baby was born. 


— All Primary Care Back Offices in England can immediately identify a patient’s NHS number from 
the PDS. Where the patient is not present on the PDS, 53% of Primary Care Back Offices can 
allocate a NHS Number immediately. This will be extended to all sites by the end of September 
2007. Subsequently, it will be made available through the Local Service Provider solutions across 


the NHS as a whole. 
5.24 Finally on this topic, at Q523 Dr Markham suggested that: 
“we have no unique identifier in England, and... ..this is one of the reasons why at the moment 


we cannot share images across the borders” and that “the technicalities of issuing them (NHS 
numbers) are too challenging at the moment.” 


5.25 On the contrary, a standard format NHS number has been introduced across the NHS in England 
and is used as the primary record key for the NHS Care Record Service. The NHS number is issued at birth 
to all babies born in England and Wales, and to adults and children not born in the UK when they register 
with a GP practice. From later this year the NHS Care Record Service will be able to assign NHS numbers 
for adults presenting for care in emergency scenarios. Although Scotland (which has a separate healthcare 
administration) uses a different numbering system, there is close coordination and cooperation between the 
two health services, and the numbering schemes are designed to be compatible with each other. It is not the 
use of different numbering schemes which prevents the sharing of digital images or other information 
between the two countries, but rather the legacy of locally-commissioned systems that are not interoperable 
and hence do not support the transfer of information across the NHS. In a typical week 6.5 million HL7v3 
messages are processed by the demographics service and 5.3 million messages by the central database, which 
is accessed on a typical NHS day by 50,000 authenticated unique users. 


5.26 Work underway currently with the authority of the National Programme Board is aiming to ensure 
that the NHS number is mandated by the Information Standards Board and subsequently adopted 
incrementally for use within IT systems across the NHS within a reasonable period. 


Section 1.2: Issues Relating to IT System Security 


6. Many of the witnesses raised issues relating to the security of the systems that the National Programme 
will provide: 


Access controls 


6.1 The Department’s evidence to the Committee in paragraphs 30-39 of EPR1 and in paragraphs 31-32 
of the further written evidence provided on 12 June 2007 demonstrate that the new systems will be protected 
by state of the art security measures of the highest standards, well in advance of what has been the case 
previously. As such, the fears expressed by some witnesses are unfounded. 


6.2 In paragraph 7 of EPR 37, Symantec implies that presently there are no access controls on NHS 
electronic records. This is not true. Existing systems have a range of access controls and the Programme’s 
systems use a proven information governance framework including role-based access control, auditing 
actions by individual user account and checks for established legitimate relationships between a clinician’s 
work group and the patient. These mechanisms, which are already in place, ensure that only appropriately 
authorised NHS personnel with an appropriate role and an established legitimate relationship with the 
patient can access patient confidential information in the NHS. Access rights given to NHS personnel are 
already monitored and audited and alerts are generated automatically when attempts to transgress these 
controls are made. 


6.3 The Programme has therefore already introduced all the controls Symantec assert are needed. A 
national NHS data store is not necessary to enforce these controls, merely that a national identity is used 
within a common information security framework with consistent information security functions applied 
across applications. This exists for all the Programme’s applications. Paragraph 6 of the Symantec evidence 
relates to the same issue but actually illustrates something that the National Programme for IT in the NHS 
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is already providing, ie a data management solution that enables patient information to be held securely and 
only made available to appropriately authorised NHS professionals. However, existing NHS procedures 
mean that, from time to time, patient information (eg demographic information) will need to be accessed 
by non-medical staff, so it is not true to assert that only medical staff will need access to patient information 
and also not true to assert therefore that only medical staff are able to keep patient information confidential. 
It is surprising that Symantec are so ill informed. 


Security of email and instant messaging 


6.4 Paragraph 8 of Symantec’s evidence concerns the security of email and Instant Messaging within the 
NHS. NHSmail, the email service operated by Cable and Wireless on behalf of NHS Connecting for Health, 
is designed and operates as a secure email service for the transmission of patient confidential data. NHSmail 
is open to all NHS employees, regardless of whether their employing trust has taken the opportunity to 
eliminate the cost of their local email service. Again, information was provided as part of the Department 
of Health’s written evidence submission EPRO1. Guidelines exist for local NHS trusts to understand the 
risks associated with Instant Messaging (in the Information Governance Toolkit and in the Information 
Governance Good Practice Guides). Use of Instant Messaging and the guidance given to users locally on 
appropriate use are matters for the local trust, which must ensure they also comply with related data 
protection legislation. NHS Connecting for Health secured an Enterprise Agreement with Microsoft in 2004 
that made secure Instant Messaging technologies available to the NHS. Implementation of these 
technologies according to existing “good practice” guidelines is the responsibility of each NHS organisation. 
The policies that Symantec assert should be given “serious consideration” already exist, either at local or 
national level. They do not need to be uniform across the NHS in order to comply with the legislation. 


Security of mobile devices 


6.5 Symantec then continues (in paragraphs 11 and 12 of EPR 37) to question the security of mobile 
devices used by the NHS. In practice, the Enterprise Agreement with Microsoft that began in 2004 gives 
access to technologies that allow NHS organisations to protect information held on mobile devices that are 
adequate for the display or use of Programme applications. All clinical applications within the Programme 
use either Transmission Layer Security (TLS) or Socket Layer Security (SSL) or Internet Protocol Security 
(IPSec) to protect patient confidential data in transit across data communications’ networks, regardless of 
whether these are across private (within N3) or public (the Internet) networks. Additionally, on Microsoft 
Windows XP, the use of Microsoft’s Encrypting File System, according to guidelines published through the 
NHS Common User Interface Programme, enables trusts to secure any information stored on mobile 
computer hard disks. 


6.6 Whilst NHS Connecting for Health has been providing guidance to NHS organisations on the use 
and security of mobile devices used in the NHS, these devices remain the responsibility of local NHS 
organisations. NHS Connecting for Health has been providing guidance to trusts on appropriate techniques 
to manage and secure all devices connected to their networks and used to access patient confidential 
information. Guidance exists that, if followed ensures trusts can secure communications over wireless 
networks. NHS Connecting for Health entered into a Corporate License Agreement with Novell in 2005 
that made Identity Management and Electronic Software Distribution software available to all NHS 
organisations. It remains a local trust responsibility to implement these technologies. The assertion (in 
paragraph 13 of EPR 37) of the need for common policies is rendered redundant by the existence of a central 
single sign-on capability in the Spine and the use of this Public Key Infrastructure (PKI) across all 
Programme clinical applications, regardless of local supplier. In other words, what Symantec suggest is 
needed already exists. 


6.7 The above paragraphs also respond to the points made by Dr Sarah Dilks in her evidence (EPR 10) 
relating to the security of data in mobile devices. Other issues that she raises are dealt with elsewhere in 


this note. 


Testing system security 
6.8 Andrew Hawker told the Committee, in response to Q160: 


“I did suggest that there should be . . . some testing that showed that you were actually operating 
in line with internationally approved information security standards, and, in the end, the simplest 
way is to have people have a go at getting into it and use other objective measures of whether it is 
easy or not to get across the security barriers that you have laid down.” 


6.9 It is easy to make such statements that imply a lack of attention to security testing but nothing could 
be further from the truth. The Committee will wish to be aware that NHS Connecting for Health places 
security testing as a fundamental requirement on all suppliers. NHS Connecting for Health incorporates 
security penetration testing requirements into its compliance process, including the requirement for 
compliance with ISO-27001. Guy Hains’ evidence to the Committee (Q280) outlined just how all-embracing 


this was. 
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6.10 It isa NHS Connecting for Health standard that security testing of National Application products 
or services is performed by “CHECK” approved security teams. This provides assurance that all primary 
and secondary suppliers to the National Programme will conduct testing to an agreed standard. The 
CHECK standard is managed by the Communications Electronic Security Group (CESG), which is the 
information assurance arm of the Government Communications Headquarters (GCHQ). The CHECK 
Teams are commissioned by the supplier of the product or service to be placed under test, both at the “Ready 
for Operations (RFO)” phase, and annually thereafter. 


6.11 The CHECK Teams work with suppliers and NHS Connecting for Health to provide the 
following service: 


(a) Devise the scope of the security testing. This may be any (or a combination) of: 
— éxternal network penetration test; 
— internal infrastructure test (weak passwords, systems unpatched etc); 
— an “Ethical Hacker” test of the actual application or database. 


(b) With the scope set, the CHECK team then produces a test plan which is agreed by both the supplier 
and NHS Connecting for Health as valid and fit for purpose. 


(c) The security test is performed by the CHECK Team. 


(d) The output of the test comprises a list of vulnerabilities. These are rated as “High”, “Medium” or 
“Low” by the CHECK Team, which identifies any vulnerabilities in the product or service which 
may compromise the confidentiality, integrity or availability of information processed. The test 
output is considered extremely sensitive and is made available only to NHS Connecting for 
Health’s Infrastructure Security Team, via encrypted media. 


(e) A Corrective Action Plan (CAP) is produced by the supplier detailing how, and within what 
timescale, each vulnerability will be fixed. This must be agreed by NHS Connecting for Health. 


6.12 Mr Hains also confirmed (Q315) that: 


“there is not a statement which says 10 breaches over a period are acceptable; it is a zero tolerance 
environment.” 


The Programme’s contracts in fact contain obligations on suppliers to comply with comprehensive and 
detailed security requirements. Suppliers are obligated to report any breach of the security requirements and 
to make recommendations for the remedy of any such breaches. NHS Connecting for Health may call in a 
third party to monitor its suppliers and make reasonable recommendations in the event of any such breach 
and/or escalate the matter for dispute resolution if the remedy proposed by the supplier is not acceptable. In 
the event of a breach of security incapable of remedy or which is not remedied, NHS Connecting for Health 
ultimately has a right to terminate the relevant contract immediately without paying any compensation to 
the supplier. 


Public access to the data 


6.13 Many industries now use the Internet to allow the public to access their data. The National 
Programme is developing HealthSpace to deliver this facility for the Summary Care Record. Healthspace is 
being developed with security integral to its design and undergoes security penetration testing from external 
experts prior to being deployed. 


6.14 Patients have the choice of having a Summary Care Record or not and of having a HealthSpace 
account or not. Where a HealthSpace account is required, strict criteria are applied for the registration of 
the patient. Once registered the patient is provided with a card containing a unique set of numbers. These 
are required to allow access to their record and avoid the weaknesses of simple username/password access 
approaches. This provides a more secure approach than adopted by most financial organisations. This 
approach will be evaluated during the early adopter programme. Other “token” technologies to manage 
access are also being considered. 


6.15 Evidence from Joyce Robins (Q190) stated that no website was secure and cited the MTAS site as 
demonstrating the fact. MTAS was not delivered by NHS Connecting for Health and did not meet the 
standards that NHS Connecting for Health operates for the National Programme. There are no grounds 
for linking MTAS with NHS Connecting for Health. 


Security of the NHS Smartcard 


6.16 The NHS Smartcard is a “chip and pin” type of card. The “chip” contains an electronic certificate. 
The NHS Smartcard uses a passcode which can be alphanumeric and longer than the four digit bank pin. 
Chip and pin cards are in use for UK retail banking and issues have been raised about the cloning of these 
cards. The cloning of chip and pin bank cards relies on the fact that most bank chip and pin cards also have 
a magnetic strip. The magnetic strip is maintained to allow for backwards compatibility with older payment 


systems and ATM access abroad. It is the magnetic strip that is copied and manipulated in the cloning 
activity. 
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6.17 NHS Smarteards are not susceptible to cloning. They do not have a magnetic strip used for 
authentication and so are not vulnerable to this attack (some do have a magnetic strip if local Trusts wish 
to use the strip for access to buildings/car parks etc but not for logon to computer systems). The “chip” part 
cannot be cloned and it is the chip that NHS Smartcards use for authentication. 


Security of centralised/distributed databases 


6.18 In paragraph 12 of EPR 03, Dr Smith said that: 


“a distributed database, with file servers in each practice, is less vulnerable to massive data loss 
through equipment failure or power outages and malicious interceptions than area-wide or 
National databases.” 

This is simply untrue, as recent events evidence. In the recent flooding at Sheffield, 12 GP practices were 
without power on the Tuesday morning. Nine of these were on shared servers. The PCT was able to facilitate 
authorised access to information to the affected practices that operated with hosted servers to enable safe 
effective care until their power was restored. This, of course was not possible for the practices without 
hosted servers. 


6.19 At the same time two practices had to be abandoned due to flooding of the premises. In the first, a 
practice of four GPs in Louth, with a list of over 10,000 patients, relocated to the local hospital emergency 
department. The practice was operational within 30 minutes of arrival due to their clinical system being 
hosted in a data centre. All that was required was their own NHS Connecting for Health security smart cards 
to allow the staff to access the system. Equipment at the practice was replaced and they returned within 48 
hours. A similar success was achieved in North Lincolnshire, where a 1500-patient practice had to vacate 
its premises. 


6.20 The security measures in place on the national system are far in advance of any implemented on file 
servers at individual practices. There is also a considerable degree of maintenance and monitoring of 
malicious activity, which we know from experience is simply not undertaken on practice-based systems. 


Security of facsimile machines 
6.21 Dr Peter Smith also claims (paragraph 11 of EPR 03) that a facsimile machine cannot be hacked. 
This is a bold statement and not borne out by the evidence. 


6.22 Due to the unauthenticated nature of facsimile transmissions, devices are susceptible to Denial of 
Service (DoS) attacks such as the sending of large documents or documents with large areas of black 
colouring. It may be possible within certain devices to limit the size of incoming documents although this 
may not prevent smaller documents being sent many times. Published facsimile device vulnerabilities 
include: 

— Polling—a feature that permits a facsimile machine to call another machine and request it to 
transmit documents 

— Redirection. 

— Forwarding. 

— Remote Control. 

6.23 Many modern facsimile devices include remote diagnostic facilities which allow hackers to monitor 

and amend the following: 
— Configuration. 
— Details of incoming calls. 
— Copies of faxes stored in the device buffer. 

6.24 Many modern multi-function devices include facsimile capability and may operate using a compact 
operating system such as Windows CE. These devices are therefore susceptible to all attacks against the 
operating system and the proprietary software which runs on them. The use and physical security of 
machines also raises security issues and, if procedures are not in place to ensure that devices which receive 
sensitive information are secured, and paper copies of faxes are not exposed to unauthorised users, then 
significant security breaches can occur. Good practice includes the use of: 

— Logging and audit of fax use. 

— Storage of fax machines in manned offices. 

— Access control to devices handling sensitive information. 
— Authorisation of faxes to prevent forgery and masquerade. 


6.25 Fundamentally, the modern facsimile is a computer with a hard drive. It stores information and sits 
on a network. It presents vulnerability because it is considered low-tech when that is not the case, and 


therefore is not appropriately patched and managed. 
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6.26 As with all technology the risks identified above can be mitigated, but to pretend they do not exist 
is quite wrong. The technology also, of course, carries with it the inherent security risks of a paper 
environment and of sensitive material being accessible on an indiscriminate basis where, for example, 
machines are left unattended. 


Illegitimate use of databases 


6.27 At paragraph 15 of EPR 08, Dr Gooderham refers to the illegitimate use of a database by those with 
legitimate access being an important potential threat to confidentiality. Whilst this is undoubtedly the case, 
the only alternative to safeguards and controls is to fail to take advantage of the significant benefits for 
patients that result from ensuring that those who need access to data have that access. Our position on the 
misuse of data was made clear in a statement published, jointly with the General Medical Council and the 
Information Commissioner, on 25 April 2007. 


6.28 Dr Gooderham also refers to the sharing of usernames and passwords in a busy A&E setting in 
Warwickshire as a cause for concern. Whilst this concern is right, in this often-quoted example the sharing 
was limited to a small number of A&E clinicians and there was no breach of patient confidentiality. The 
A&E Department has recognised that they were acting in breach of NHS Connecting for Health’s smartcard 
policy and the poor practice has now ceased. The time taken for authentication and to start the application 
was the key reason cited for the need to share cards. These have been reduced significantly through 
improvements in the technology and process over the past 12 months. NHS Connecting for Health is 
working with SHAs and PCTs on reviewing smartcard usage across the NPfIT with the aim of ensuring 
smartcards are not shared and that organisations enforce the no smartcard sharing policy. 


Security of locally-owned desktop computers 


6.29 NHS Connecting for Health does not own or manage the desktop computers through which users 
access the Programme’s applications. This is the responsibility of the local organisation and as such comes 
under the organisation’s security policy. The local organisation is responsible for ensuring that local 
applications are suitably protected against unauthorised access through the implementation of solutions 
such as desktop screensavers. 


6.30 NHS Connecting for Health ensures that National Programme applications provide functionality 
to protect against unauthorised access to patient information from unattended sessions. This functionality 
ensures that the application is terminated after a set period of inactivity. The applications are protected by 
NHS Connecting for Health’s Spine Idle Timeout solution. NHS Connecting for Health is working with the 
health professional bodies to provide national guidance on the appropriate values of inactivity timeouts 
across different care settings. 


6.31 Access to NPfIT applications can be protected further through the ability to disable access for users 
reporting lost or stolen smartcards. 


Reliability and security documentation 


6.32 Finally on system security, Professor Randell was not told (Q316) that NHS Connecting for Health 
did not have reliability and security documentation. He was told that this existed but that, for reasons of 
confidential and commercially sensitive content, they could not be disclosed to third parties without 
reference to the suppliers. 


Section 1.3: Issues Relating to System Performance 


7 A number of issues were raised relating to the capacity, reliability and performance of the 
Programme’s systems: 


System resilience 


7.1 The Department supplied a note on system performance and resilience to the Committee. In respect 
of Symantec’s evidence (paragraph 9 of EPR 37), relating to ensuring critical information, applications and 
systems are available continuously, all Programme systems have the levels of protection Symantec assert to 
be vital; and all the assertions made in Symantec’s evidence are therefore without foundation. Professor 
Randell also commented on NPfIT systems’ resilience and the likelihood of failure (Q325). It should be 
noted that Professor Randell is one of the 23 academics who called for an independent review of the National 
Programme in April/May 2006. At that time, this group foretold of catastrophic failures with the systems 
being implemented. Whilst no new problems have emerged, many more systems have been implemented and 
system reliability and resilience continue to be high, as evidenced by the system availability figures published 
on NHS Connecting for Health’s website. The group of academics has not produced any evidence to warrant 
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a review but merely produced newspaper articles and a series of Parliamentary Questions—hardly the 
evidence” one would expect from computer scientists. However, in view of the comments from these two 
sources, a further note of evidence is enclosed as Annex 1 of this note. 


Professionally run data centres 


7.2 It is also worth adding some information in support of the points made about the merits of 
professionally run data centres (Q594). The TPP primary care application is a data centre hosted application 
provided by CSC to NHS providers in the North, Midlands and East of England. Whilst the service is well 
regarded in its own right, recent flooding in the UK has demonstrated very clearly the additional benefits 
of the National Programme’s approach at GP surgeries in flood affected areas: 


— data is held securely in a remote data centre, not locally, and therefore no loss of data occurred 
and no re-creation of records was required; 


— no data loss was experienced, where a locally hosted system could have endured a hard service shut 
down due to sudden electricity power failure; 


— local Business Continuity Plans are enhanced because GPs can connect to the service from any N3 
connected site (eg in an alternative GP surgery or local hospital) with minimal configuration; 


— there is minimal disruption to re-establish service once the local GP premises and infrastructure 
are restored—no locally hosted servers to be rebuilt to enable access to system. 


As explained above, these benefits have been demonstrated at GP surgeries in Grimsby and Louth in the 
last two weeks. 


Response times of IT applications 


7.3 In respect of Q598, which related to the speed of IT Applications and/or networks in GP surgeries, 
alot of support has in fact been provided by NHS Connecting for Health to PCTs and GP practices to ensure 
that local configuration of legacy systems provides a good end user experience. Local PCT IT teams have 
a key role to play in this. For example a study of over 900 PCs at one PCT showed that poor user experience 
relating to 71% of the PCs was because the PCs themselves required remedial action, or were under the 
minimum specification. 


7.4 The N3 broadband network service provider (BT) and the principal legacy system supplier (EMIS) 
have also worked together to investigate reported performance issues of the EMIS LV application, when 
operating over the N3 “Main to Branch” Network, and to provide a fix to the issue. The results from the 
trials have been very encouraging with the joint team witnessing significant improvements to how the 
application is now running over N3. 


Dependency on the systems of Choose and Book 


7.5 Returning to the evidence of Dr Peter Smith, he says, in paragraph 18 of EPR 03, that access to 
services such as Choose and Book should not be dependent upon the medical record upload. It is important 
to note that with respect to the data around individual patients, it is not. It does, however, depend on the 
infrastructure, namely, the N3 network, the security framework, the demographics service and the 
messaging infrastructure. 


Capacity of the bandwidth 


7.6 In EPR 37, paragraph 3, Symantec said that: 
“ due to the lack of bandwidth allocated to the database, the Spine will not be able to hold all 
the medical information relevant to each patient. The lack of bandwidth means the amount of data 
able to be stored on the database will be limited and the ability to download the data in any 
meaningful timeframe restricted.” 


7.7 This statement is not only untrue, but also makes little sense. The term “bandwidth”, as commonly 
used in the context of Information Technology, is a measure of the capacity of a data communications 
network to transmit a volume of data over a period of time (usually expressed in millions of bits (binary 
digits) per second). The NHS New National Network (N3) has sufficient capacity to provide adequate 
bandwidth between any two locations in the NHS that need to exchange data. As evidence of this, NHS 
organisations routinely transfer diagnostic images in digital format of several tens of megabytes (there are 
eight bits per byte and a megabyte is over one million bytes) across this network, throughout the day, using 
the Picture Archiving and Communications Service (PACS). The N3 network transmits seven terabytes 
(millions of megabytes) of data each day. Further information has already been provided as part of the 


Department of Health’s written evidence EPROI. 
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7.8 Clinical records, in comparison to diagnostic images (X-ray or MRI scan images), are relatively small 
amounts of data; perhaps a few megabytes at maximum, once coded using appropriate clinical terminology. 
To suggest that there is insufficient bandwidth for the Spine and that this limits its ability to hold all medical 
information is clearly wrong. Even if the assertion related only to the database capacity necessary to store 
all detailed patient records, this is still wrong, since the database products that store Spine data are already 
used for other databases many times the size of that needed to store 50 million detailed patient records. 


7.9 To exemplify the point with more specific detail, the data centres hosting the Spine are provisioned 
with resilient (dual) network links. These links have recorded 99.99% availability over the last 12 months 
(against a 99.9% Service Level Agreement (SLA)). The availability of the Spine Data Centre and its services 
has been 99.97% over the last 12 months (against a 99.7% SLA). All Data Centres in this infrastructure are 
architected to have fault tolerant network connections featuring assured end-to-end separation of the two 
physical cables entering the Data Centre. This means that at no point in their journey between the Data 
Centre and the rest of the network are they close enough to fail or be damaged in a single action. Within 
the Data Centre, this separation continues, with separate local area network links, separate power supplies, 
separate network adapters in the separated pairs (or clusters) of servers providing this service. 


7.10 Presently, the average size of a detailed medical record sent over the National Programme’s GP2GP 
service between GP EHR systems is approximately 547 kilobytes (indeed, less than 1% of detailed medical 
records so far transferred are larger than 5 Megabytes). Even if these detailed records were to be transferred 
to the Spine it would not cause problems for the links in the N3 network or to the Spine Data Centres. The 
N3 network has a range of capacities available for site connection, each installed appropriate to the site’s 
individual needs. The “core” of the N3 network has a capacity of 4.5Gbps. Such a network is able to transmit 
an average detailed medical record in less than one millisecond. The links into the Spine Data Centres can 
transmit the average detailed record in just over 56 milliseconds (a twentieth of a second). This means that 
even if all detailed records did need to be transmitted to the Spine in one go (a highly unlikely situation, but 
useful as a “worst case scenario”) with the network links upgraded to their maximum capacity, it would take 
less than 5 days to transfer 50 million records. This highly unrealistic “worst case scenario” illustrates that 
the capacity available in the network to deal with detailed medical records, even if they were to be sent to 
the Spine, is easily adequate for the job. 


Section 1.4: General Programme Related IT Issues 


8. A number of more general issues were raised in respect of the Programme’s IT products and services: 


Cerner Millennium Release 0 


8.1 To clarify Q389/90, Cerner Millennium Release 0 (RO) is the clinical application implemented at both 
the Newham and the Homerton Hospitals. 15 NHS hospital trusts to date across London and the South 
have elected to implement Release 0 as a precursor to the full clinical suite of Cerner Millennium Release 
1. This incorporates a fully anglicised Patient Administrative System, together with the clinical applications 
that support Ordering and Results Reporting of diagnostic tests and care pathways. 


Maintenance of the vision of integrated records 


8.2 In response to Q398, where it is suggested that the focus has been on hospitals rather than primary 
care and that the vision of an integrated system has been lost, it should be noted that In London 42% of all 
PCTs and half of all mental health trusts have implemented the Local Service Provider (LSP) Rio 
application. This solution will be integrated fully with the Cerner Millennium solution to provide a patient 
centric integrated solution, working across organisational and professional boundaries. In the North, 
Midlands and East, the LSPs have implemented nine GP systems and over 1,200 applications to Primary 
Care Trusts to support the delivery of Community Services. 


Would the same progress have been made without the Programme? 


8.3 Dr Cundy observed (Q81) that: 


“we have now recently developed technology, through a project which was begun before the 
national programme, to exchange GP records wholesale from one practice to another. Six hundred 
practices in the country have that, and it is almost getting on for 10%, and that exchange can occur 
in a matter of minutes.” 


It is a matter of speculation as to how far forward this process would have moved without the involvement 
of NHS Connecting for Health, bearing in mind that enabling it depends on the existence of a reliable 
network with suitable bandwidth and the definition of adequate standardisation and messaging structures. 
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None of these would have been in place without the Programme. When NHS Connecting for Health 
announced on 19 March 2007 the first interoperable transfers of Electronic Health Records in Croydon 
PCT, Dr Cundy was widely quoted as saying: 


“These first transfers of GP electronic patient records between different practices using different 
computer systems is a watershed for patients, practices, the Programme and the NHS. It represents 
a significant and tangible leap forwards in the modernisation of the NHS and is a tribute to close 
collaborative and clinician led working. I would like to personally congratulate the entire team and 
look forward to the next stages of widened supplier involvement and national rollout.” 


8.4 To make it happen on the ground NHS Connecting for Health has driven GP2GP forward within a 
structured project management framework and ensured that the solutions developed, and being developed, 
by the clinical system suppliers are subject to a rigorous compliance process. This ensures that clinical and 
patient safety is at the fore and that Spine interactions are carried out safely. Clinical systems which do not 
comply in these areas cannot be accredited as GP2GP-compliant. 


8.5 Dr Cundy also stated (Q96) that many of the PACS systems being installed now are the PACS systems 
that were on order books in 2001-2004 but were put on hold: 


— Of the 122 Trusts that no had form of PACS in 2003, only 31 had live PACS projects. 


— Ten of these 31 Trusts went on to implement these projects outside of the Programme. They were 
therefore not “put on hold”. 


— The other 21 have implemented, or are implementing, NHS Connecting for Health’s PACS 
solution. In many cases delays were experienced because of trusts’ failure to write business cases. 
They could hardly be described as ready to procure their systems. 


8.6 In a similar vein, Dr Markham told the Committee (Q508) that: 
“the Southern Cluster, as is now, was almost ready to roll out (PACS).” 


This is not so. The Southern cluster was in fact purely a consequence of co-operation between the newly- 
created National Programme and the Broadband Britain initiative, to segment the NHS into regional 
groupings suitable for the maintenance of a contestable framework. 


8.7 Finally, Dr Cundy stated (Q99) that it was “not a good thing” that general practitioners will be offered 
a choice of suppliers for their electronic record system. This is in direct conflict with a quote by him in the 
13 February edition of “e-health Insider” magazine that: 


“this (The GP Systems of Choice initiative) is great news for GPs and great news for the 
programme. I am reassured that this is finally going to happen.” 


Sealed envelope functionality 


8.8 Guy Hains commented (Q305) that he would need to see a more detailed specification than that 
contained in the spine functionality plan to implement sealed envelopes within his Local Service Provider 
(LSP) environment. Sealed Envelope functionality will be delivered in the Spine in 2008. LSP solutions will 
deliver Sealed Envelope functionality in two phases: 


— in the detailed care record; 
— _ inthe messages that the LSPs exchange with the Spine. 


The Sealed Envelope integration with the Spine can occur only post 2008 after the Spine functionality 
is delivered. The major sub-contractors (iSoft and Cerner) have committed to delivering Sealed Envelope 
functionality in 2009. 


Direction of information flow 


8.9 Professor Korff was wrong to suggest (Q198/99) that there will be only one direction to the flow of 
information from local to central records. Right now local NHS records are deriving their demographic 
information from the centrally held Personal Demographics Service. We envisage that local records will pull 
through elements of the national record to ensure patients enjoy continuity of information. Medications and 
allergies are an obvious example. At the very least local records should compare themselves to the national 
Summary Care Record and highlight to the responsible clinician when they are different. 


Purpose of the secondary uses service 


8.10 Dr Walport was not well informed when he said (Q336) that the initial aim of the Secondary Uses 
Service (SUS) was about management. Misgivings about the name should not be taken as impiying that the 
need to support research was not designed into the care record specification at the outset. The published 
specification in July 2002, the contract specification in May 2003 and the first SUS consultation document 
in February 2004 were all explicit in identifying the requirement to support research. 
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Structure of the electronic health record 


8.11 Dr Sarah Dilks (in paragraph 3 of EPR 10) seems to assume that the electronic health record is a 
single unstructured document. That is not the case. The electronic health record is structured in a number 
of ways, and access to information is “partitioned” in a number of ways. Additional evidence was provided 
to the Committee on this subject on 12 June 2007. To be clear: 

For the Summary Care Record held on the Spine: 

— Each entry is held separately with a set of data to identify it including author and organisation. 
— Within each entry Care Record Elements categorize the data, eg, Medications, Allergies, etc. 


— Entries to the Summary Care Record are submitted using structured HL7v3 messages so the 
structure can be maintained. 


—  Ifanentry contains sensitive information the patient may place it in a Sealed Envelope. 


— Role based access ensures that people can access only the information about a patient which is 
relevant for them in their role, so a doctor can access clinical information, but a receptionist may 
access only booking data. 

— Legitimate relationships ensure that in all instances access to patient information held in the NHS 
Care Records Service creates an audit trail of who accessed what information and when. 
Inappropriate access generates an alert to a Caldicott Guardian who may investigate the matter 
further. 

For the Detailed Care Record held on local systems: 

— Data is stored ina structured data store (typically a relation database) with each element identified 

within that structure. 


— The principles of Legitimate Relationships and Role Based Access Controls referenced above are 
also applicable to accessing detailed records. 


SECTION 2: TIMING AND DELAYS 


9. Delays to the Programme were cited by a number of witnesses. The Department’s evidence accepted 
that delays have occurred though some of the evidence of individuals is worth commenting on: 


Priority of electronic prescribing 


9.1 Frank Burns said (Q544) that electronic prescribing: 
“is not a priority of NPfIT, and it should be one of the first things that are rolled out across the 
hospital service”. 


In fact, ePrescribing is a priority but the specification was not available at the commencement of the 
National Programme and NHS Connecting for Health has worked hard to get it in place. This has involved 
wide consultation. 


9.2 The functionality to be provided by ePrescribing systems is now extensively detailed in the 
ePrescribing Functional System. It will include: 


— computerised entry and management of prescriptions; 
— knowledge support, with immediate access to medicines information; 


— decision support, aiding the choice of medicines and other therapies with alerts such as drug 
interactions; 


— computerised links between hospital wards/departments and pharmacies; 
— ultimately, links to other elements of patients’ individual care records. 


9.3 The programme will also focus on supporting the new working processes and cultural changes needed 
to make the introduction of ePrescribing systems a success. 


9.4 LSPs are currently developing the basic and advanced ePrescribing components of their strategic 
solutions and are currently contracted to deliver ePrescribing between 2008 and 2010. Separately, £11.5 
million capital funding has been made available to acute trusts via SHAs to purchase interim oncology 
ePrescribing systems, to treat oncology ePrescribing as a priority, in support of the National Cancer Plan. 
It was a condition of the funding that procurements should commence by 31 March 31 2007. 


Problems with legacy data 


9.5 In general, the extent to which the time required for the implementation of Patient Administration 
Systems (PASs) is affected by data quality is determined by the priority given, and the resources made 
available, in individual organisations to cleanse data prior to migration. In total this can easily amount to 
several man years of specialist input. Indeed the scale of the task, exemplified by Mr Hains (Q276), to 
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eliminate duplicate and corrupt data when replacing existing computerised records cannot be overstated. 
NHS organisations have an accumulation of current and historic data held within their patient indices on 
their PASs and other electronic systems, or on paper records. Duplicate records exist in all PAS systems, 
mostly created when patients use different names or addresses to records already held, or when NHS 
numbers are not used. Duplicates also exist when hospitals merge and continue to operate two or more PASs 


simultaneously. It is estimated that most existing/legacy systems operate with a duplicate rate in excess of 
%. 


9.6 The introduction of the NHS Care Record Service will result in closer integration of national and 
local records (both demographic and clinical) and the opportunity to build an individual’s summary of key 
clinical events, diagnostic results and current medication. It is important therefore that the quality of the 
information recorded is high and that the number of duplicate records on the system is minimised, as any 
level of duplication will increase clinical risk, 


Progress on interoperability 


9.7 The reference by Dr Paul Cundy (Q102) to “moving towards” interoperability does not adequately 
reflect the level of progress achieved. Some 115 systems have now been through the compliance programmes 
for the new IT systems. This has created a level of systems’ interoperability that was unimaginable three 
years ago, as a result of which, in a typical week 6.5 million HL7v3 messages are processed by the 
demographics service and 5.3 million messages by the central database, which is accessed on a typical NHS 
day by 50,000 authenticated unique users.” 


Delays to PACS in the North West 


9.8 Dr Markham told the Committee (Q551) that: 
“the North West and the West Midlands [PACS] is delayed, because there were some contractual 
problems initially.” 


In fact, the subcontracted PACS’ provider to the main supplier missed a number of key milestones. Their 
contract was terminated and another vendor was selected by CSC. A proven alternative solution was 
subsequently delivered to the NHS within three months. This is an example of the procurement 
arrangements working as designed. 


SECTION 3: LocaL NHS costs AND AFFORDABILITY 


10. There has been much misinformation about the costs and affordability of the Programme, most of 
which can be dismissed following the publication of the NAO’s study of the Programme last year. 


10.1 Frank Burns told the Committee (Q556) that: 


“the resources are all locked up in NPfIT, and... . nobody can do anything because NPfIT has 
the money.” 

The figures simply do not bear out this assertion. Whilst there has been significant investment centrally 
in the National Programme through NHS Connecting for Health it is also the case that local IT spending 
in the NHS is significantly greater than that on the central programme and NHS IT spendind is also 
continuing to increase. This is demonstrated in the table below: 


Table: Local NHS spending on Information Management and Technology—increases on previous year: 





2004-05 2005-06 = 2006-07 (planned) 
Total IM&T spend (£’°000s) 1,251,814 1,398,335 1,576,716 
£’'000s increase over previous year 103,286 146,521 178,381 
‘% increase Over previous year 8.99% 11.7% 12.76% 





10.2 There is further evidence that local costs are reduced significantly as the systems are supplied 
through the Programme. Annex 2 contains illustrative examples of affordability comparisons between 


NPfIT solutions and local procurements. 


10.3 The central PACS’ procurement also demonstrated significant advantages over local procurements; 
with many commodity items costing 70% less than previous procurements. The significant delays in rolling 
out the PACS applications were due to NHS trusts’ inability to get business cases approved by their Boards 
and the subsequent raising of Purchase Orders. There would have been considerable additional delay had 
Trusts attempted to justify business cases where the cost of ownership was considerably more expensive than 


was achieved by the Programme. 
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10.4 Dr. Markham implied (Q512) that the lack of availability of resources—subsequently provided 
through the National Programme—was the key obstacle to the rapid deployment of PACS. When the 
National Programme took on board acceleration of the procurement and deployment of PACS, one 
difficulty was that many radiologists wished to specify a local system, which would have driven up costs and 
delayed implementation. However, deployment of PACS under the Programme is not necessarily the same 
product as the earlier deployments. The National Programme systems offer a Trust: 


— Trust-wide PACS 

— Radiology Information System integrated fully with the PAS and PACS 
— PACS in A&E, theatres and on wards 

— Cross site access to images 

— Access from outpatient clinics and outreach clinics 

— The support of specialisms such as orthopaedics. 


The installations prior to the National Programme did not all have this scope and it is this broadening of 
scope and widening of availability that has led to the delivery of benefits. 


10.5 Frank Burns stated (Q516/7) that he had had a very sophisticated, fully functioning clinical system 
for 17 years. The Wirral Hospital NHS Trust elected to undertake independent procurement in 2004 for the 
replacement of the system that had a very high cost of ownership. The procurement was based on the NPfIT 
specification for clinical applications for an NHS acute hospital. The Trust, at considerable cost to the NHS 
and to the supplier community, got to “preferred bidder” stage in 2006. However, the cost of the solution 
was over twice that already achieved by NHS Connecting for Health for the Cerner Millennium Solution. 
Minded of the advanced functionality already enjoyed by Wirral Hospitals NHS Trust, and that their 
solution would “expire” at the end of 2007-08, putting patients and staff at risk, NHS Connecting for Health 
agreed with Fujitsu Services (the LSP for the South) to make available the Trust’s preferred supplier’s 
application at the NPfIT contracted rates. Subject to satisfactory conclusion of commercial discussions, the 
Wirral Hospital NHS Trust is planning to take the Cerner Millennium PAS in the first quarter 2008. Of 
course the substantial cost of procurement incurred by the NHS could not be recovered. 


10.6 Contrary to Dr Taylor’s evidence (Q546) the Shires Consortium did not include early delivery of the 
PACS applications. The consortium was a loosely federated purchasing consortium that demanded different 
applications and approaches to implementation, but that agreed to procure services locally. The cost of the 
Shires’ procurement as determined in the business case was at least double that obtained during the NPfIT 
procurement. The NPfIT procurement further enjoyed more beneficial terms and conditions, greater levels 
of integration and significantly improved service availability for the NHS. 


SECTION 4: THE SUMMARY CARE RECORD AND PATIENT CONFIDENTIALITY 


11. Many witnesses commented on the summary care record and the confidentiality issues. Most of the 
witnesses support the concept. The Department of Health gave extensive oral evidence on this issue, as well 
as making the case for the record in its initial written evidence (EPR 01) and in its further note dated 12 June 
2007, which aimed to clarify some of the issues that had arisen at the oral hearings. 


The summary care record 


11.1 The Summary Care Record will be populated initially from the patient’s computerised GP notes 
(unless a patient dissents from storing or sharing their record with the Summary Care Record system). It 
will be made available to authorised clinicians within the Out-of-Hours setting. As the Department indicated 
in its original written evidence to the Committee, the initial summary upload will include: 


(1) Patient demographic details: 
— Current and other address details (eg contact address when different). 
— Date of birth. 
— Contact details (telephone numbers, email address etc). 
— NHS number. 
— Contact preferences including preferred language. 
— Consent status. 


(2) Medications (Repeat prescriptions in last six months, acute prescriptions in previous six months, 
discontinued in last six months) 


(3) Allergies and adverse reactions. 


_ 11.2 Subsequent uploads can include other information that the GP and the patient think would be useful 
in the Summary Care Record, including: 


— Diagnosis. 
— Treatments. 
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— Problems and issues. 

— Care events. 

— Clinical observations and findings. 
— Investigation results. 

— Risks to patient. 

— Family history. 

— Lifestyle. 

— Social and personal circumstances. 
— Personal preferences. 

— Provision of advice and information to patients and carers. 
— Administrative procedures. 


11.3 In areas where hosted GP systems are being rolled out by Local Service Providers, out-of-hours 
services will be able to access shared GP systems directly from the LSP data centre. Specific Out-of-Hours 
functionality is being developed to ensure that appropriate controls and functions are available to the out- 
of-hours’ community. This will provide data and facilities to ensure far greater continuity of care than that 
currently generally available. 


Consultation on the summary care record 


11.4 The answers given by witnesses to questions 177-186 do not reflect the extensive consideration and 
consultation that has taken place on the consent issue. The issue has been considered by seven separate 
groups, all of which concluded that opt-out was the most appropriate policy. 


11.5 The policy that patients should opt out of having a Summary Care Record was proposed in 2003 
by the NPfIT National Programme Board based on recommendations from the NPfIT Patient Advisory 
Group and the National Clinical Advisory Group, the membership of which included the Medical Royal 
Colleges and other clinical bodies. The recommendation from the National Programme Board was 
approved by a Ministerial Taskforce on NHS Information Technology in November 2003 and was 
subsequently endorsed by Ministers. The Ministerial Taskforce included members from the patient 
community, the NHS, the Department of Health, the Academy of Medical Royal Colleges, the BMA, the 
Royal College of Psychiatrists and the Government e-Envoy. Information has already been provided as part 
of the Committee’s evidence session on 26 April 2007. 


11.6 The Care Record Development Board (CRDB), established in 2004 and chaired by Harry Cayton, 
asked its Ethics Advisory Group, chaired by Professor Dame Joan Higgins, who also chairs the statutory 
Patient Information Advisory Group, to revisit the opt-out policy. The Ethics Advisory Group 
recommended that the previous decision that patients should opt out was appropriate. The CRDB 
considered the evidence and accepted the advice of the Ethics Advisory Group. 


11.7 In September 2006 a Ministerial Taskforce on the Summary Care Record was established, chaired 
by Harry Cayton. The membership of the Taskforce included the NHS, patient representation, the BMA, 
the Royal College of General Practitioners, the Royal College of Nursing, the Professor of Bio-ethics from 
Oxford University and the College of Emergency Medicine. The Taskforce considered the opt-out policy 
and, having recommended an appropriate period to allow patients to opt out, supported it unanimously. 
The Taskforce set out clearly the arguments for and against both the opt-out and opt-in positions in 
paragraphs 4.34.5 of its report. They concluded that it was more ethical to allow patients to opt out. 


11.8 All the information published makes it clear that patients have a choice and that the NHS will 
continue to provide the best care that it can irrespective of whether patients have a Summary Care Record. 


Explicit consent 

11.9 In paragraph 6 of its written evidence to the Committee (EPR 11) Patient Concern expressed the 
view that the explicit consent of patients should be gained prior to uploading data into the Summary Care 
Record. The Ministerial Taskforce did not support this approach. Concerns over an explicit consent 
approach have been that it would: 

— takeconsiderable time to implement and therefore delay the delivery of the benefits associated with 

having a Summary Care Record; 
disadvantage the most vulnerable members of society who may benefit most from the new record 
but may not be provided with one for a considerable period, or who may be difficult to contact to 


gain consent. Patient Concern’s suggestion that vulnerable people could be contacted in writing 
to obtain consent is misleading as the very nature of their vulnerability would exclude many such 


individuals; 
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— require everyone to take action when, based on the experience of other countries who have 
implemented similar electronic records, only a very small minority will request not to have a 
Summary Care Record at all. In Canada a legal requirement for explicit consent was swiftly 
amended when health professionals complained about the time taken away from patient care when 
more than 99% of patients were not concerned about appropriately managed electronic health 
records. 


11.10 Patient Concern also suggested that developments in France and Greece had demonstrated that 
explicit consent can be gained for the upload of records. No specific evidence was provided about the relative 
scale of developments in those countries, though it is accepted that in some circumstances it would be 
practicable to gain explicit consent. However, there are no true comparisons between the creation of the 
Summary Care. Record and developments in these other countries. The cost of an explicit consent process 
for 50 million people, in terms of NHS staff time and the associated opportunity cost of patients not seen, 
particularly in the light of the position adopted by the Ministerial Taskforce, is not sustainable. 


Sealed envelopes 


11.11 Professor Korff told the Committee (Q195) that: 


“provisions about sealed envelopes that cannot be opened without the consent of the data subject; 
and the right of every patient regularly to receive a log of every person in the NHS who has had 
access to his data, including, I daresay, any researcher who has access to his data and who can be 
identified. Those are safeguards that can be built in; they are not envisaged here now.” 


11.12 Professor Korff also stated (Q218) that he understands that: 


“all the data in the sealed envelope will be available for research with minimal anonymisation and 
pseudonymisation.” 


He said that the 
“envelopes are not sealed very well” and that “It is fairly easy for practitioners to break them 


open.” 
11.13 Professor Korff's understanding is flawed and the statements he made are incorrect. Patients will 
have the choice of two types of sealed envelope: 


— The first, which we refer to as sealed and locked, prevents data from being available outside of the 
clinical team that recorded the information, whether for research or any other purpose. The data 
will remain available to those who recorded it whilst they are caring for the patients. 


— The second, the ordinary sealed envelope, does permit data to be extracted, in a fully anonymised 
form for research purposes, and it will also be available for clinical staff in emergencies when the 
patient is unconscious or with the patient’s consent. The mechanism for breaking the seal in these 
circumstances is simple, though there are strong managerial controls to prevent misuse, as it is 
expected the seal will need only to be broken without consent at times when the patient concerned 
is in desperate need for urgent care. Whenever the seal is broken the circumstances will be 
investigated and the patient will be informed. 


11.14 The NHS Alliance presented written evidence to the Committee on this topic (EPR 19). In their 
paragraph 3.1.4 they said: 


“Again, the NHS Alliance would recommend that . . . patients should also be informed when their 
sealed envelopes have been opened. This is not planned at present and is a SERIOUS omission; 


11.15 In due course patients will be notified, through HealthSpace, whenever there is activity on the 
record involving a change in the sealed record status. This includes creating a seal, breaking a seal, and any 
action to override dissent. In addition, a NHS Caldicott Guardian/Privacy Officer will receive an alert when 
a seal is broken (with or without consent from the patient). Virtually any action, including changes to sealed 
record status and clinicians self-claiming legitimate relationships so they can break the seal, creates an audit 
trail. Patients cannot access their audit trail directly (through HealthSpace or any other route); though Data 
Protection Act Subject Access Request provisions will provide this information on application. 


Safeguarding confidentiality for patients with mental and sexual health issues 


11.16 Joyce Robins expressed her concerns on confidentiality for patients with mental and sexual health 
issues to the Committee on 10 May 2007 (Q204). On 15 March 2007, over a hundred clinicians, information 
governance staff and representatives of patient groups in Reproductive and Sexual Health Medicine came 
together to debate whether the safeguards being offered by the National Programme were enough for the 
specific confidentiality needs of this community. Throughout the day, delegates were asked to discuss a 
range of issues and provide answers using tablet PCs on their tables; some were repeated at the end to see 
whether opinions had changed. 
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| 1.17 One question that showed a shift in views was: How do you feel the National Programme for IT 
will affect the confidentiality of information (including test results) in your clinical environment? 


eee 





Before After 
Will improve 6% 15% 
May improve 23% 51% 
Unlikely to impact 15% T% 
May worser: 37% 16% 
Will worsen 19% 11% 





11.18 A very clear steer on what delegates wanted was provided by questions such as: Who should decide 
how far information is shared? 
— Patient: 23% 
— Clinicians (Genito-Urinary Medicine clinic, reproductive health service or GP): 0% 
— Patient and clinician together: 77% 
— NHS Connecting for Health: 0%. 


Section 10 of the Data Protection Act 


11.19 In paragraphs 5-11 of his written evidence (EPR 08), Dr Peter Gooderham refers to and quotes 
Section 10 of the Data Protection Act 1998, which provides patients with the right to require a Data 
Controller, in this case, the Department of Health, to cease processing personal data where this is causing, 
or may cause, substantial damage or substantial distress where that damage or distress are unwarranted. He 
suggests that breach of confidentiality may be regarded as “substantial damage”, but recognises that there 
are exceptions to Section 10 and quotes one such exception where the processing is in the vital interests of 
the data subject. 


11.20 The Department of Health accepts that this may be the case, but any consideration of the 
application of Section 10 must be conducted on a case by case basis. This would need to consider: 

— the content of the record and the damage or distress that might be caused by unauthorised 
disclosure; 

— the circumstances of the data subject—keeping records of an individual who puts others at 
significant risk may be warranted even where this causes the individual concerned substantial 
damage or distress; 

— the importance of the record to the data controller or others—the need to maintain evidence 
against future complaint or litigation may require the record to be kept even where a patient 
objects; 

— the safeguards and controls that are in place, as, if there is no risk of breach of confidence, then 
the Section 10 notice may be rejected. 

11.21 In paragraph 10 of his submission, Dr Gooderham suggests that if prominent individuals such as 
MPs are allowed to object, but others are not, then such a distinction may be discriminatory. Whilst, at the 
direction of Ministers, all adult patients may choose not to have a Summary Care Record, there is no other 
automatic right to prevent processing. Any request, regardless of the celebrity of an individual, will need to 
be considered on a case by case basis. 


How many will opt-out of the summary care record? 


11.22 Experience from the early adopter primary care trust areas in England where the summary care 
record is being trialled shows that the number of people who wish to opt out of the Summary Care Record 
has been very significantly exaggerated on the strength of the views of a small minority. Only just over a 
thousand people out of a total of over 350,000—less than one third of one percent—have to date requested 
not to have a summary care record. The following statistics provide the latest information from the Early 


Adopter Programme: 

— 9,952 clinical records have been uploaded to the NHS CRS; 
350,759 letters detailing the NHS CRS options available have been sent to patients, resulting in a 
total of628 calls to the NHS CRS Helpline; 
939 consultations have taken place at public events and at the practices that have so far contacted 
their patients; 
the number of patients choosing not to have a summary care record is 1,068 (0.29%). 
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Incremental approach to developing the summary care record 


11.23 Joyce Robbins, apparently on the strength of attending a single presentation, misrepresents (Q203) 
as ill-considered and ad hoc what is in fact a planned incremental design and consultation process for 
developing the Summary Care Record. Our Care Records Service National Clinical Reference Panel 
(Chaired by Dr Simon Eccles, NHS Connecting for Health) is actively considering further content and 
enhancements of the Summary Care Record. The Reference Panel includes representative clinicians from a 
wide range of nursing, medical and allied health backgrounds and many different care settings. It also 
includes patient and patient advocate representatives. Information was provided as part of the oral evidence 
session on 14 June 2007. 


11.24 The Panel is taking a very broad look at the future of the Summary Care Record, taking care to 
balance any possible future addition against the need to keep the summary record as a clinically useful and 
accessible record which does not swamp the user with information. It will be looking at suggested future 
content with specific regard to enhancing patient safety; increasing clinical and patient utility; and the 
benefits of the additions compared to the technical difficulty of achieving them. As ever, the intention is to 
consult with the widest possible range of clinical and patient stakeholders. 


Early adopter sites 


11.25 As explained in the Department’s written evidence EPRO1, the deployment of the Summary Care 
Record (SCR) has started in the Early Adopter PCTs. The Early Adopter Programme will run to April 2008 
and is subject to an independent evaluation by University College London. The Early Adopter Programme 
will refine the implementation approach and facilitate preparation for the subsequent National roll-out that 
is expected to commence in financial year 2008-2009. To date: 


— SCR implementation has started in two PCTs (Bolton and Bury). 


— So far, the two PCTs have sent letters to over 350,000 patients (100% Bolton patients and 59% 
Bury patients) initiating the process. 


— Both PCTs have launched significant public information programmes to inform their patients. 


— The SCR upload process has begun in Bolton and the local out-of-hours provider is preparing to 
begin access (to commence in August). 


— Bury PCT will follow shortly (there is a 16 week period between the patients being informed 
through letters and the commencement of access to their records). 


— Shortly following access for out-of-hours in Bolton and Bury, access will be made available in 
other unscheduled care settings (eg Accident and Emergency, NHS Walk-in Centres, Minor 
Injuries Units and Ambulance Services). 


11.26 The other Early Adopter PCTs have plans in place and are currently in the advance stages of 
preparation for launching the SCR. 


Electronic records for children 


11.27 On 10 May 2007 the Committee considered some issues relating to electronic health records for 
children (Q206 onwards). The Care Record Development Board has established a working group to 
examine the issues around electronic records for children. The group is chaired by the DH National Clinical 
Director for Children, Young People and Maternity Services and its members represent the National 
Children’s Bureau, the Royal College of Nursing, the General Medical Council, Safeguarding Children, 
Sure Start and Information Sharing and Assessment Units of the Department for Education and Skills, the 
Royal College of General Practitioners, the Royal College of Midwives, the Royal College of Paediatrics 
and Child Health, the Royal College of Obstetricians and Gynaecologists, the Office of the Children’s 
Commissioner, the Royal College of Psychiatrists, the Community Practitioners’ and Health Visitors’ 
Association, the Department of Health and the NHS. 


11.28 The group has considered the issues surrounding electronic records for children, including 
discussing them with a group of children, and has produced a new section for parents and older children in 
the 2007 revision of the Care Record Guarantee (already submitted to the Committee by Harry Cayton). 
This describes the rights of parents and children around access to children’s records. The group is also 
producing an appropriately targeted version of the Care Record Guarantee for younger children. The 
children and young people’s section of the Guarantee stresses the importance of developing autonomy for 
young people. 


11.29 It seems that in responding to these questions Ms Robins and Prof. Korff have confused detailed 
care records and the Summary Care Record. The question asked whether it should be mandatory for 
children’s detailed care records to be stored electronically. The position is that detailed records of treatment 
have to be kept and it is the responsibility of the clinician providing the treatment not only to keep the record 
but also to decide the medium on which the record will be kept. Patients, or in this case possibly their parents, 
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can request that records are not kept electronically but they cannot demand it. The merits of electronic 


records in terms of security, legibility and transferability via the GP to GP transfer functionality are well 
documented. 


11.30 Professor Korff raised the issue of parents consenting to a detailed record for a child. His example 
was one of a child with leukaemia where the child requested not to have a record at an age when they were 
considered competent. As far as detailed records are concerned, paper records have a minimum retention 
period and it is right that electronic ones do too. We are currently consulting with the regulatory bodies and 
the medical insurers what the retention period for electronic records should be. The Committee might wish 
to note the reduced storage requirements of electronic records. 


11.31 It has always been made clear that, having initially said that they wanted a Summary Care Record, 
patients can change their minds and this applies equally if a parent has decided that a child should have a 
Summary Care Record and when they become competent the child disagrees. As the Summary Care Record 
may have been used as part of treatment it cannot be deleted and so is archived and can only be accessed if 
needed for medico-legal purposes. 


11.32 The National Programme’s Child Health Programme is also exploring the potential for 
information sharing to the benefit of the child. This includes consideration of issues relating to children’s 
records in terms of accessibility and sharing. They will be taken fully into account when drawing 
conclusions, with specific attention to: 


— thecurrent and emerging policy position and initiatives, including the obligations currently placed 
on NHS bodies to provide certain information about children to other public agencies; 


— guidance from the joint work of the Care Record Development Board, under the chairmanship of 
Harry Cayton, and the Director for Children, Young People and Maternity (Sheila Shribman); 


— the outcome of legal advice that has been sought. 


11.33 The Child Health Programme is also looking to build on the existing (paper-based) Personal Child 
Health Record (the “Red Book”), issued for all children, as an exemplar of the potential content of a shared 
record and also of the issues involved in access and sharing of this record for health professionals with the 
consent of the parent. 


11.34 The Child Health Programme sees its remit as to identify solutions to implement current policy for 
children as it relates to information sharing, taking account of professional and legal perspectives as well as 
policy drivers. 


11.35 Professor Korffs assertion that the NHS will attempt in a divisive way to incorrectly infer the 
competence of children is wrong. Neither the NHS, nor the Programme, is developing or seeking to assert 
its own policies regarding information sharing. 

11.36 In addition, NHS Connecting for Health has been working very closely with the previous 
Department for Education and Skills to implement the policy “Every Child Matters.” This work aims to 
ensure that healthcare practitioners and other care professionals working with children can be identified to 
share information when vulnerable children are at risk. 


Availability ef HealthSpace 


11.37 Joyce Robins also said (Q191): 

“I do not know when [Healthspace] will be available.” 

Basic HealthSpace functionality to act as a personal health organiser is already available to all patients 
aged 16 or over in England. Patients are currently able to record and manipulate information such as their 
weight, smoking habit or alcohol consumption to help them manage their health. Calendar and diary 
functions are also available and Healthspace also gives patients access to the Choose and Book on-line 
booking service. It is therefore wrong to assert that HealthSpace does not exist. 

11.38 Recently, HealthSpace has added the capability for patients to view their Summary Care Record 
(SCR) once they have been uploaded to the Spine. This capability is being rolled out to a number of Early 
Adopter PCTs during the remainder of the year in line with the roll-out of the SCR itself. A national roll- 
out of this functionality is intended from 2008 onwards. Detailed planning to achieve this will be undertaken 
once the lessons learned and feedback from the Early Adopters is available. 

11.39 It is expected that from some point in 2008, HealthSpace will allow patients to add information to 
their SCR. The items that can potentially be added to the SCR are: 

— Religion—the religion of the patient 
Spiritual support—whether the patient would like to see a representative of their faith during a 
stay in hospital 
Religious customs—details of any religious customs that the patient would like to observe during 
a stay in hospital that may require special facilities or considerations (eg prayer facilities, 
Ramadan etc) 
— Dietary requirements—patient’s dietary preferences eg Vegetarian, vegan, etc 
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— Access requirements—what special access needs does the patient have? 

— Transportation—does the patient require hospital transport to get to their appointment? 
— Wheelchair user—Is the patient a wheelchair user? 

— Hearing aid user—does the patient have a hearing aid? 

— Patient comment—multi-purpose free text comment entered by the patient. 


11.40 The Care Record Service Design Steering Group is considering these options and HealthSpace will 
implement those items which are considered to be suitable by the appropriate HealthSpace governance 
boards. 


11.41 Separately from the SCR, future options for HealthSpace to become a utility provider of 
personalised health information are being considered. This is likely to include more facilities to help patients 
manage long term conditions and chronic diseases. 


NHS use of identifiable and non-identifiable patient data for care and for secondary uses 


11.42 The oral evidence provided by certain witnesses to the Committee on the distinction between 
identifiable data and non-identifiable data, how these may be used and shared, and how they are protected in 
the National Programme’s systems, was poorly informed and at times misleading. To provide clarification, a 
note has been included as Annex 3. 


SECTION 5: CONSULTATION AND PROFESSIONAL ENGAGEMENT ON THE SYSTEM SPECIFICATION 


12. One recurrent criticism is that there has been insufficient consultation, especially with clinicians, 
around the overall design and operational aspects of the National Programme. This was examined 
extensively by the Committee on 14 June 2007, when the Department gave evidence of just how much had 
been done, whilst agreeing that there is always a case for doing more. 


12.1 Attached for information (at Annex 4) is a copy of a response to a Parliamentary Question given 
on 21 June 2007 to Stephen O’Brien MP by the Department’s then Minister of State, Caroline Flint, on this 
matter. This demonstrates the depth of consultation on the specification of the NHS Care Records Service. 


12.2 Dr Hale told the Committee (Q273 and Q312) that: 


“speaking from the point of view of my own trust and the Royal College of Psychiatrists, we have 
not been able to make a great deal of input.” 


In fact clinicians from across the spectrum of clinical specialties were given the opportunity to contribute 
to the specification of the requirements. The extent to which this opportunity was taken up in each case is 
not something the Department could necessarily influence. The specification itself was built on years of 
experience across the NHS, and many clinicians were involved in the drafting—in particular the Academy 
of Colleges Information Group contributed the first module of the specification for the NHS Care Record 
Service. During 2003, a group of clinical advisors worked with the National Programme; this included 
Martin Elphick, a consultant psychiatrist from Oxford. The nature of the contracts (using the OGC- 
approved method of producing an Output-Based Specification) means that the specific design is the 
responsibility of suppliers, but with users involved in the review of supplier proposals. The later consultation 
activities, covering areas such as consent and sealed envelopes, have been led by the National Clinical Leads 
within NHS Connecting for Health, in conjunction with representative professional bodies. The principle 
is to ensure full user engagement in the definition of requirements rather than the technical design of the 
solution. 


12.3 Engagement with the Royal Colleges has been an ongoing process throughout the life of the 
Programme. In 2002, the representative body was the Academy of Colleges Information Group (ACIG), 
which brought together input from all the Royal Colleges. This group commented on the July 2002 
specification and contributed an entire module to the 2003 specification. From the earliest days of the 
Programme meetings were held with leaders of the colleges. Peter Hutton then set up the National Clinical 
Advisory Board is 2003, and this took over the responsibility for bringing input from the Royal Colleges. 
Professor Michael Thick, as the Chief Clinical Officer of the Programme, with his team, has now taken on 
this liaison role. 


SECTION 6: EVALUATION AND BENEFITS 


13. The Programme will be subject to evaluation. In 2006 NHS Connecting for Health commissioned 
Birmingham University to run an overall programme of evaluation on its behalf—the “NHS Connecting 
for Health Evaluation Programme.” This programme of work is headed by Professor Richard Lilford. 
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Evaluation of the NHS Summary Care Record Early Adopter Programme 


13.1 Subsequently, University College London (UCL) was awarded the contract to conduct a year-long 
independent evaluation of the NHS Summary Care Record Early Adopter Programme, to fall within the 
wider programme. UCL were selected following a competitive tendering exercise run by Birmingham 
University which saw seven applicants submit bids to conduct the evaluation. The year-long evaluation 
commenced formally on 1 May 2007 and a final report is due to be published in the summer of 2008. 


13.2 The primary aims of the evaluation can be summarised as: to assess usability, usage, functionality 
and impact of the Summary Care Record in Early Adopter sites, and place this in context; to set the stage 
for the step-wise inclusion of further sites and further data sources; to provide timely feedback to 
stakeholders; and to contribute to the generation of an evaluation culture within NHS Connecting for 
Health and the National Programme for IT. 


13.3 The evaluation will inform the national rollout of the SCR from 2008 onwards although any 
emerging findings will of course feed into the ongoing implementation of the Summary Care Record within 
Early Adopter communities. 


Benefits of PACS 


13.4 In her evidence (Q217), Joyce Robins cast doubt on the benefits of having digital X-rays 
automatically uploaded to detailed care records. At the end of June 2007 benefits analysis for the first year 
of PACS implementation had been completed for 65 Trusts. The total financial benefit in the first year of 
service was approximately £18.5m, with £9.9m of this total saving being projected by 48 trusts from data 
recorded 3 months after the implementation of PACS. Additionally some Trusts have reported reductions 
in the incidence of repeat X-Rays by over 75%. Reporting times and the percentage of reports completed in 
48 hours have also improved significantly, and this has been shown to be influenced by the deployment of 
digital dictation and voice recognition. 


Loss of benefits if patients have the right to remove their NHS electronic record 


13.5 Returning to the evidence from Symantec in EPR 37, paragraphs 4 and 5 effectively support the 
objectives and case for the National Programme, although the assertion that full benefits will not be realised 
if patients have the right to remove their NHS electronic record is a gross oversimplification. Benefits of 
storing medical data electronically accrue largely to the patients themselves; hence lack of an electronic 
medical record mostly impairs the patient’s ability to receive safe and efficient medical care. The reduction 
of NHS benefits is largely a consequence of lowering the efficiency of processes to deal with patients when 
they have no electronic record and these inefficiencies scale with the number of patients electing this option. 
These inefficiencies are largely operational (it will take more time to treat a patient without an electronic 
record) and are only indirectly related to the inability to benefit from the change in technology. 


Benefits of mobile clinical records 


13.6 The recently reported evidence emerging from the early implementations of mobile clinical records 
is precisely the opposite of what Dr Dilks suggests at paragraph 8 of EPR 10. In the community staff-based 
trial in Nottingham!'* where laptop computers were connected through encrypted wireless links to the NHS 
network (N3), the results of the trial showed that on average staff had 38 minutes additional productive time 
per person per day with the potential to save 60 minutes a day. The trust saw a reduction in travel times of 
32% and realistic additional potential to reduce commuting by 50%, with the potential for a 25% increase 
in productivity. 

Nationally, in broad terms the number of front line staff who have access under the National Programme 
for IT to shared electronic health records is as follows— 


13.7 On average 96% of patient notes were completed on the day, rather than a typical delay of up to 48 
hours previously. Users perceived an average of 70% improvement in facilities to do their job. The success 
was not limited to one particular group of clinicians. The trial included community matrons, paediatric 
physiotherapists, paediatric occupational therapists, and paediatric speech and language therapists. A video 
of the clinicians talking about their experiences is available'®. Security and staff training were included within 
the trial. 


13.8 Emerging evidence of savings and efficiencies on this scale are extremely compelling. When the new 
hardware (discussed below) becomes available at the end of the year we expect to see rapid take-up and 
deployment of clinical systems in the community-based services. 


4 http://www.ehiprimarycare.com/news/item.cfm?1D = 2855 
'S http://www. healthexectv.tv/home.asp 
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13.9 Trials of mobile computing platforms are currently in progress in several acute trusts, including 
Salford Royal NHS Foundation Trust and University Hospitals Coventry and Warwickshire NHS Trust. 
Evidence from the Salford trial with the phlebotomy service showed very rapid changes and improvements 
in clinical workflow. This has led to Phlebotomists being able to: 


— start new orders whilst mobile. This enabled laboratory processing to begin sooner—potentially 
speeding result-reporting, as well as treatment plan adjustments; 


— resolve questions quickly. The portability made it easy for phlebotomists to locate requesting 
clinicians, address questions, and capture corresponding order-updates; 


— chart each blood draw at, or close to, the time of the event. This gave phlebotomists a sense of 
completion, minimising the chance of forgetting important information, and making information 
available more quickly to other clinicians; 


— ensure positive patient identification. The built-in radio frequency identification (RFID) reader 
enabled phlebotomists to positively identify those patients wearing RFID wristbands; 


— _ reduce paperwork; 
— eliminate the need to wait for access to a hospital ward’s personal computers to enter patient data; 


— avoid unnecessary blood draws resulting from previously unrecognized discontinued orders. 
Needle sticks are painful and stressful for patients. Avoiding these unnecessary draws has benefited 
patients and enhanced overall service efficiency. 


13.10 A larger business benefits analysis is currently underway in Salford but early results show patient 
discharge being accelerated by a half day. 


13.11 As part of the wider picture NHS Connecting for Health’s Technology office has been working 
closely with Intel to catalyse and define a new category of mobile computer (“mobile clinical assistant”) 
designed specifically with the clinician in mind. Four suppliers (with more to follow) have announced that 
they are working on the delivery of units to this specification. Without the input from NHS Connecting for 
Health it is unlikely that these units would have been built. The work was done by Intel and the suppliers 
at their own risk. No NHS monies were spent on the development or prototyping of the devices. 


SECTION 7: PUBLIC INFORMATION AND PATIENT SAFETY 


Section 7.1 Issues Relating to Public Information 


Use of the postal service 


14.1 Also in her evidence (Q187), Joyce Robins said that what: 


“we suggest is that when this bit of rubbish goes out to patients with it should go a copy of the 
record that is going to go in. Connecting for Health very quickly jumped on me and said that the 
postal system was not nearly secure enough for that.” 


This point needs further explanation. 


14.2 The letter had, in fact, been trialled with patients during its development and discussed with the 
Information Commissioner. Sending letters and leaflets to patients in the post is one of several strands of 
the Public information Programme that supports the introduction of the Summary Care Record. Alongside 
the letters and leaflets are road-shows in prominent local locations, support centres (Information Booths) 
within PCT premises, posters and leaflets in GP surgeries and advertising campaigns in local media. The 
independent evaluation of the Early Adopter Programme will examine the effectiveness of each strand of 
public information activity. 


14.3. Whilst sending letters and leaflets is an effective part of a wider information programme, it is not a 
suitable mechanism for sending print-outs of patient records to large numbers of patients. Information from 
the University Hospital Birmingham suggests that 3% of mail was misdirected prior to the introduction of 
the Personal Demographics Service and 0.44% after its introduction. For a PCT with 300,000 patients, a 
0.44% misdirection rate would lead to over 1000 misdirected patient records. In addition, there are further 
concerns and risks posed by shared addresses and potential risks in the postal service itself (for example, 
Postcomm’s £9.62 million fine applied to Royal Mail in August 2006 for failing to secure mail). 


_14.4 Instead, through the Public Information Campaign, the patients will be told where they can go to 
view their record (the location is arranged by the PCT). This way, a patient’s identity can be checked prior 
to revealing sensitive patient data. 
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The public information campaign 


14.5 In her response to Q196, Joyce Robins either seems to believe the Hampshire project was a part of 
the National Programme, or seeks to make direct comparison between the two. Both are a misconception. 
The public information programme supporting Summary Care Record Early Adopters is not the same as 
the information campaign implemented in Hampshire and the Isle of Wight. NHS Connecting for Health 
held a workshop with the team from Hampshire and the Isle of Wight specifically to learn the lessons from 
the information campaign that had been implemented there. These were: 


— that patients need to be told a specific date by which they need to make their decision on whether 
to opt-out or not. As a result, the letter sent to patients in Early Adopter PCTs tells them by which 
date they need to tell their GP surgery if they wish to opt-out; 


_ that not enough information was available to patients who wished to opt-out. Additional 
information is available to patients who wish to opt-out of having a Summary Care Record. This 
includes information on the implications of choosing to not have a Summary Care Record; 


— that more information was needed about where the information came from and who would have 
access to it. The information available at Early Adopter PCTs tells patients where the information 
comes from and who can access it; 


— _ that there weren’t enough sources of information for patients other than by phone or email. NHS 
Connecting for Health has made additional materials available to patients including a detailed 
leaflet about confidentiality and patient records and the Care Record Guarantee Drop-in sessions 
are also available for face-to-face conversations for those people who would prefer to discuss 
their options; 

— more could have been done to reach foreign language speakers and ethnic minority groups. The 
leaflet about the Summary Care Record is available in twelve languages, the leaflet about 
confidentiality in six and the Care Record Guarantee in thirteen. Leaflets are also available in 
Braille and large print. Audio support is also available. Leaflets can be ordered by phone, post or 
email. As a result, NHS Connecting for Health supports the Early Adopter PCTs to engage and 
reach hard-to-reach groups within their local areas; 

— Hampshire and Isle of Wight used Royal Mail’s household drop service which means one un- 
personalised letter or information pack per household. This was thought ineffective. The NHS 
Connecting for Health Public Information Programme includes sending a personalised 
information pack to all registered patients aged 16 and over. 


Section 7.2: Issues Relating to Patient Safety 


15.1 In response to Q246, Joyce Robins presents a partial interpretation of patient safety statistics. The 
figures she quotes imply a level of significant (if non-fatal) incidents resulting from lost records of roughly 
equivalent numbers to those of MRSA-related deaths annually. But this is only a small piece of the greater 
issue. A study of adverse drug reactions as a cause of hospital admission published in the British Medical 
Journal in 2004'° concluded that: 

— one in 16 hospital admissions are the result of an adverse drug reaction (ADR)—72% of which are 
avoidable; 

— this equates to 4% of hospital bed capacity; 

— at any one time the equivalent of 7 x 800 bed hospitals are occupied by patients admitted with 
ADRs; 

— ADRs causing hospital admissions are responsible for the death of 5,700 patients every year; 


— the annual cost to the NHS is £466 million. 


15.2. This and other powerful evidence of the very significant patient safety benefits to be achieved from 
electronic patient records is provided in the paper attached as Annex af 


15.3 To suggest that: 
“medical records ... ..can be provided by GPs within 48 hours, or shorter” 


is a disingenuous comfort to patients who present for treatment, ever increasingly, out-of-hours or for 
unscheduled care. To cite one tragic recently-reported case, that of Penny Campbell, who contacted the out- 
of-hours service eight times over four days, the doctors working for the out-of-hours service treated each 
contact as a “one off” because none of them had access to her clinical record; and none of the doctors after 
the first had been aware of the earlier contacts. One of the criticisms of the circumstances was that the patient 
had been required to describe her symptoms on eight separate occasions. The inquiry concluded that the 
paper-based system of record keeping used by the out-of-hours service was a direct factor in the patient’s 


death. 
cS 


16 Pirmohamed, M. et al: Adverse drug reactions as a cause of admission to hospital: prospective analysis of 18,820 patients: 
BMJ 2004; 329: 15-19. 
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SECTION 8: OTHER ISSUES 


Accountability for delivery of the Programme 


16.1 In his oral evidence (Q519/20) Frank Burns suggested that accountability for delivering the 
Programme has been and remains too centralised. This issue has in fact been addressed. The NHS Chief 
Executive, David Nicholson, initiated the NPfIT Local Ownership Programme (NLOP) in October 2006, 
in line with the recommendations of the National Audit Office report, to re-position the Programme as part 
of mainstream NHS business, and to ensure that the products and services being delivered under NPfIT were 
meeting the current priorities of the NHS. 


16.2 On 1 April 2007 formal accountability for implementation and the realisation of benefits moved to 
the Strategic Health Authorities. SHAs are now responsible for the local prioritisation of NPfIT systems, 
establishing and overseeing local implementation plans and local product and service requirements. 


16.3 NHS Connecting for Health continues to be responsible, within the Department, for the NPfIT 
commercial strategy, contractual negotiations with suppliers, management of NPfIT funds, national 
services and products, the provision of the Programme Office and the development, maintenance and 
enforcement of the national NPfIT architecture. To ensure relationships with Local Service Providers 
continue effectively, three local Programmes for IT have been established, for London; the South; and the 
North, Midland and East. The Programmes for IT will work alongside the SHAs to facilitate a joined-up 
approach in implementing NPfIT across constituent SHAs. 


16.4 In respect of the response given to question 501, whilst the National Programme has been in 
existence since 2002, NHS Connecting for Health was established on 1 April 2005. 


16.5 Nicholas Beale (in EPR 14) suggests that the creation of NHS Connecting for Health was simply a 
re-branding exercise. This is not the case. The NHS National Programme for IT has retained the same name 
since its inception. The Programme is delivered by NHS Connecting for Health which, as an agency of the 
Department of Health, delivers all the national IT requirements of the NHS, including the legacy services. 
The Agency was set up in April 2005 following the closure of the NHS Information Authority. This was 
done for administrative and efficiency reasons, taking account of a separate decision to establish the NHS 
Information Centre. It had nothing to do with re-branding the Programme and no action was taken to 
suggest that it was. 


16.6 Whilst dealing with Nicholas Beale’s evidence, it is not right to suggest that the Programme’s origins 
are at arms’ length from the front line of the NHS. The Chief Executive of the NHS is the Senior Responsible 
Owner of the Programme. 


Evidence submitted by Stalis Ltd (EPR 05) 


16.7 The evidence from Stalis makes a number of inaccurate claims and appears to reflect the fact that 
the company failed in its bid to be a National Programme contractor and wishes to continue to market its 
existing systems. 


16.8 Their remarks about the “haste” in getting the contracts in place contrasts with the NAO’s 
conclusion of “commendable speed.” The NAO also reported on the strength of the contracts. Although 
Stalis complain of haste, it should be noted that most successful suppliers complain that multi-year 
government procurement arrangements are unsatisfactory. 


16.9 Annex 6 of this note shows that 115 existing systems’ suppliers have obtained work under the 
Programme, which refutes Stalis’ allegations in their paragraphs 6-11. Stalis inaccurately quotes remarks 
made by Richard Granger regarding the very poor level of interoperability of systems, including those 
provided by Stalis Ltd. These remarks were made some five years ago, expressly about systems which were 
unable to move data on the same software between sites. It is assumed that this is a failing in functionality 
which Stalis would not continue to support. 


16.10 In respect of paragraph 8 of Stalis’ evidence, the very considerable number of NHS existing 
systems’ suppliers that have obtained work under the National Programme (Annex 6) provides substantial 
contradiction of the selective marshalling of information on this matter. Some 60% of the hospital-based 
systems were procured from a UK listed entity; the major central infrastructure components of the 
Programme (the Spine and N3) were also procured from a UK listed company; and a UK entity, 
ConMedica, was selected originally for 20% of PACS business. 


16.11 Contrary to the assertion made in paragraph 9, relevant experience of comparable projects and 
subcontractor mix was evaluated alongside the resource arrangements that the suppliers had in place. For 
example, the selection of IDX from the USA, though not an LSP, as the main subcontractor for the London 
and the South Cluster areas was on the basis of their successful deployment at the Chelsea and Westminster 
NHS Trust, which remains far in advance of the product marketed by Stalis Ltd. 


16.12 The assertion at paragraph 10 regarding experience of the NHS on the Programme in 2002 through 
to 2005 is also untrue. In 2002 the Programme was led by Professor Sir John Pattison, the former Dean of 
a medical school, the Director of Research, Analysis and Information at the Department of Health. 
Subsequently, the Programme was co-led by the Deputy Chief Medical Officer, a distinguished 
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gynaecologist and obstetrician, Professor Aidan Halligan and a substantial number of senior NHS 
personnel have been involved continuously in the Programme both as clinicians and senior managers. 
Similarly, the assertion that the suppliers had had no NHS involvement is also untrue. BT was, in 2002, the 
largest supplier of services to NHS trusts with an annual turnover in excess of £200 million. 


16.13 Contrary to paragraph 11, it is not true that funding was unavailable for migration and cleansing 
of data. Funding for this is provided in two ways. Firstly, the trusts get to keep the savings from their existing 
contracts with organisations such as Stalis Ltd, following the implementation of national systems. In 
addition, £166 million has been provided over the period 2004-5 and 2005-6 for this express purpose. It 
should not go without comment that the cleansing of data within existing systems, such as those supplied 
by Stalis, is something which the company assumes it is right should funded by the National Programme. 


16.14 Paragraph 12 alleges that: 


“the LSPs commenced the programme with little or no experience in UK healthcare and little 
experience anywhere of the systems required by the NHS. Although this has improved with some 
LSPs it is not consistent across the NHS and remains an issue today.” 


In fact, assessment of prime contractor capacity and capability at the pre-qualification stage of the NPfIT 
procurements required evaluation of relevant similar services. The prime contractors who subsequently 
became LSPs provided examples of their experience. These are contained in Annex 7 of this note. 


16.15 Contrary to paragraph 14, the substantial cost of ownership of legacy systems was very well 
understood. This cost remains a driving force for reducing the number of configurable components within 
the Programme, since the cost of acquiring interoperability is above and beyond the NHS funding envelope. 


16.16 Paragraphs 20 and 21 contain some broad-brush assertions that are not borne out by the facts. The 
involvement of, for example, System C, Hedra, Tribal and others are examples of pre-existing NHS expertise 
being used to the greatest extent possible, but, unlike previously, within contracts which now provide 
adequate protection to the taxpayer. 


16.17 The National Programme is a transformation programme for the NHS that will underpin the 
Government’s system reform programme. It is supporting delivery of key reforms such as patient choice, 
the 18 weeks referral to treatment patient pathway, the GP contract, and practice-based commissioning, but 
at the same time is designed and is being engineered to retain flexibility to adapt to, and adopt, future policy. 
The risks suggested in paragraph 23 are therefore being managed. 


16.18 Far from being a “counterproductive” task as suggested in paragraph 26, replacement of some 
long-standing PASs is essential. Many are facing hardware obsolescence and software which is unsupported. 
Not to replace them will put the care of patients in those hospitals at unacceptable levels of risk and it would 
be irresponsible not to proceed with replacement, simply because some software suppliers would like to see 
continuity of revenue. 


16.19 In paragraph 27 Stalis fails to acknowledge that the devolved approach had not made acceptable 
progress across the NHS as a whole. The NHS Care Records Service will provide an integrated national 
service for all NHS clinical applications. This is being delivered as part of an overarching information 
strategy that allows the portfolio of systems from the Local Service Providers and the existing systems’ 
providers to be integrated into a coherent service. The clear evidence that this approach is proving effective 
is that 115 systems have been through the compliance programmes, creating a level of systems 
interoperability that was unimaginable three years ago. 


16.20 The statement in paragraph 34 that the UK supplier industry was ruled out is fundamentally 
wrong. That they were uncompetitive in part, undercapitalised and unable to contract with well-capitalised 
global players, is not something which could be blamed on the Department of Health. Further, the corporate 
failures or frailties of Torex, iSoft, and ConMedica all validate arrangements which avoided direct 
contracting with small and mid-sized entities that were unable to bear payment on completion risk for a 
programme of this scale. Preferential treatment for domestic suppliers, on this criterion alone, would have 
been unlawful under the EU Procurement Directive and WTO arrangements. 


16.21 The final specific comment on the Stalis evidence relates to their paragraph 43. The policy of self- 
determination advocated by Stalis is largely incompatible with the objective of safer patient care— 
recognised as important at their paragraph 39—which is supported and enhanced by the interoperability of 
systems and Spine compliance provided under the National Programme. 


16.22 More generally, Stalis clearly believes that it is possible to integrate multiple different systems to 
common standards to allow joined up care. However, they fail to acknowledge that prior to the inception 
of the National Programme for IT there was little evidence of this being done. The NPfIT has created the 
environment which will allow this multi-system approach to become a reality through the central 
architecture (that has been successfully delivered) and by the Local Service Providers acting to coordinate 
multiple suppliers in the overall delivery. The LSPs have become more plural over time (eg BT using Rio 
and InPractice Systems as well as Cerner; CSC using The Phoenix Partnership and HSW as well as iSOFT). 
This trend is increasing and will become more apparent in the coming months. 
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16.23 The criticisms levelled by Stalis are of an already past world from which NHS Connecting for 
Health has moved on in order to serve the NHS better. The LSP actions to diversify their portfolio of 
systems, the Existing Systems Programme, GPSoC and more recently the procurement exercise to increase 
the number of suppliers to the Programme are all clear evidence of this. 


16.24 Stalis’ reference to statements made by Richard Granger to the UK supplier community at the 
outset of the Programme seem not to appreciate that this was in effect part of a negotiation which has led 
to a much better deal for the NHS both in the short term and for years to come. Many UK suppliers have 
benefited from this process. Contrary to what Stalis imply, many UK NHS expert IT suppliers are part of 
NPfIT. These include for example: 


— The Phoenix Partnership, providing GP/Primary Care/Child Health/Community solutions across 
the North, Midlands and East; 


— CSE Servelec, providing Mental Health/Community solutions in London; 
— HSS providing Radiology Information Systems in all areas other than London; 
— In Practice Systems providing GP Systems in London; 


— Liquid Logic and CSW providing Single Assessment Process (SAP) solutions to link with Social 
Care; 


— Health Solutions Wales (HSW) providing Child Health Systems in the North-West; 
— Clinisys providing Pathology Systems in London; 
— PICIS providing Theatre Systems in London; 


— SystemC providing implementation support services nationally. 


16.25 All of these organisations are peers to Stalis in terms of size and expertise in the NHS and all of 
them are UK companies. Stalis was not offered the opportunity to become Choose and Book/Spine 
Compliant because they had only one EPR installation within the NHS at the time (2005). All investment 
made by the NHS would have been just for that one site. In choosing Silverlink as the replacement PAS, 
Moorfields chose a system from a company that had successfully replicated and grown its business, working 
with iSOFT (Silverlink Patient Care System (PCS) was sold as iSOFT iCS). Silverlink was also amongst the 
first Acute suppliers to achieve Choose and Book compliance (it is installed at Harrogate and Mid Cheshire, 
both early Choose and Book adopters). 


16.26 The current list of Choose and Book compliant Acute PAS systems (non-LSP ie equivalent to 
Stalis) is as follows: 


Supplier System 
Anglia | 
Ascribe eCAMIS 
Ascribe Barwick 
Ascribe EPEX 
Atos Helix 
Cambio Cosmic 
Capula OASIS 
EDS Swift 
Filetek Meditech 
IMS Maxims Hearts 
IQ Systems Utopia 
iSOFT Clinicom 
iSOFT iExpress 
iSOFT iPM 
iSOFT iCS (Silverlink PCS) 
McKesson Totalcare 
McKesson STAR 
Misys CPR 
Streets Heaver Compucare 
SystemC Medway 


16.27 Stalis also fails to recognise that the required expertise in programme management necessary to 
implement the programme was non-existent within the NHS, which had never previously managed 
programmes of anywhere near the same size. The appointment of Richard Granger and that of other IT 
professionals brought large-scale programme management expertise and included NHS expertise in the 
team from the outset. 
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Evidence submitted by Symantec (EPR 37) 


16.28 Comments on Symantec’s evidence are included in relevant parts of this note. On a general point, 
their generally critical stance with regard to the National Programme needs to be understood in the context 
of its own commercial interests. In early 2005 Symantec approached the National Programme for IT with 
a proposition to procure licenses centrally, on behalf of the NHS, for Symantec’s Ghost Solution Suite 
product. Symantec presented NPfIT with anecdotal information it had gathered about the use of Ghost 
within the NHS. Symantec had performed a survey of NHS trusts in the months leading up to contact with 
NPYIT, ostensibly to gauge demand for their anti-virus products, but had also asked how trusts had installed 
“images” of their standard desktop software onto new computers. Without validating their responses, 
several trusts had replied that they used Ghost. Symantec took this anecdotal information from the trusts 
they spoke to and extrapolated it across the whole of the NHS in England. When compared with their sales 
records from their resellers and direct channels, this information suggested a significant under-licensing of 
the Ghost product across the NHS. NPfIT were presented with an offer to agree an enterprise wide 
agreement on behalf of the NHS or Symantec would start legal action. The scale of the NHS and the relative 
immaturity of its local IT asset management capabilities in 2005 meant that to prove whether Symantec’s 
claims were accurate or not would have cost the NHS several millions of pounds in largely manual surveys. 
It was known that other technologies had been used to create these desktop “images”, but to prove the 
relative use of these versus Symantec’s Ghost product would still have necessitated a full survey. As the least 
cost and least risk option for the NHS, NPfIT robustly negotiated an agreement with Symantec to cover 
the NHS with an Enterprise Wide Agreement for Ghost Solution Suite at a cost approaching £1.8 million 
for perpetual licenses and time-limited support, which was duly put in place in July 2005. Symantec did not 
then pursue any legal action. 


Evidence submitted Tom Brookes (EPR 70) 


16.29 The evidence submitted by Tom Brookes contains some significant inaccuracies which is surprising 
since he claims to have been involved in the early stages of the programme and continues to operate as a 
management consultant in the NHS. He declares other connections that link him with evidence submitted 
by other groups. The NHS Numbers project that he claims to have led in the mid-1990s installed a 1970s 
batch system that, whilst improving the allocation of NHS numbers from manual processes at the time, has 
significant drawbacks through the time taken for batch processes to operate in the effective allocation of 
NHS numbers when babies are born to ensure accurate identification. The on-line Personal Demographic 
Service that provides a much needed replacement for Mr Brookes’ project under the Spine contract will 
enable immediate access from over 7,000 locations with over 70,000 users to 50 million records to 
immediately allocate a NHS number on-line and enable improved and accurate identification of babies in 
the first hours and days when attention is needed by multiple clinicians and midwives. 


16.30 Mr Brookes maintains that Newham and Homerton hospitals procured IT systems outside of 
NPfIT. This is because the contracts were awarded in 2003 following a procurement that preceded NPfIT. 
The Trust has since assigned their contracts to BT within NPfIT and took disaster recovery and affordability 
issues into account in coming to that decision. The Chief Executive of Homerton has taken a leading role 
on the Programme Board of the London Programme for IT as part of the National Programme which 
demonstrates evidence of commitment that Mr Brookes overlooks. Similarly, Wirral hospital initially 
investigated a separate procurement route but chose to continue within NPfIT with a Cerner product. The 
same is true of Bradford, Shires and University College London who decided that NPfIT offered the 


greatest value. 


16.31 The references to the detailed care record are simply inaccurate. It has never been the intention to 
make a detailed care record available nationally and evidence was submitted on 12 June 2007 to clarify the 
difference between the summary and the detailed record. All published documentation refers to a summary 
care record being made available at the point of need and this will bring real benefits for patients requiring 
unscheduled care. In contradiction with the allegation that this is too complicated and unachievable, the 
summary care record is already live in the early adopter sites in Bolton. The witness casts doubt on the 
delivery of the Spine functionality. However, the performance of BT in meeting Spine release delivery dates 
has delivered the last 14 of 14 releases on or ahead of time. 


16.32 The allegations about the architecture and the Spine being unable to cope are unfounded. The 
Spine has been sized and tested to accommodate the needs of the NHS and the performance in supporting 
over 350,000 registered users who have accessed Spine records over 350 million times to date is regularly 
meeting or exceeding service levels. The publication of the Message Implementation Manual (MIM) to all 
suppliers working with NPfIT demonstrates a robust approach to standards and architecture that enables 
on-line interoperability between multiple systems that transfer patient information for the benefit of the 
patient. This was not possible with the NHS Number system that is lauded by this witness. 
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16.33 The references to a monopoly situation with suppliers are also untrue. The replacement of 
ComMedica as a PACS supplier for poor performance and the replacement of Accenture and IDX 
demonstrate that there is a competitive marketplace. The inclusion of existing system suppliers having 
achieved over 100 compliant releases of software also bears testimony against this incorrect allegation. 


16.34 This witness is in collaboration with the other groups that have called for an independent review 
but have, as yet, produced no evidence that would warrant such a review. 


Helen Wilkinson 


16.35 Ms Robins stated incorrectly (Q247) that Helen Wilkinson has been denied registration with a 
doctor. The fact is that Ms Wilkinson refuses to be registered with a doctor because the consequence of 
registration is that a record is kept centrally of that registration as a matter of law. Ms Wilkinson continues 
to claim that she is being denied NHS care. Again, that is absolutely not the case. Ms Wilkinson refuses to 
present for NHS care because of the consequential record keeping that would result. The care is there and 
available to her, but not on her terms. The architecture of NHS IT and NHS business processes must respect 
the legal rights of individuals, but it must also be as efficient and cost effective as possible and cannot be 
tailored to provide individuals with costly bespoke arrangements. Ms Wilkinson continues to pursue her 
claim for financial compensation from the Department of Health and the NHS and to actively campaign 
against the NHS IT modernisation programme. 


Department of Health 
16 July 2007 


Annex 1: System resilience and the likelihood of failure 


Note: Detailed information about system performance and resilience has been provided previously by 
the Department in a note to the Committee. However, further information is provided here. 


In evidence submitted by Prof Randell, he quotes a friend’s guesstimate that the NPfIT system would be 
likely to fail every four days. This assertion is not supported by any evidence and does not concur with the 
live service availability consistently being demonstrated by the Programme’s systems. Service availability 
statistics are published weekly on the NHS Connecting for Health web site. 


It appears that Prof Randell is making the assumption that the NPfIT is delivering a single computer 
system. The NPfIT in fact consists of a large number of discrete computer systems or “Services” built and 
delivered by many different suppliers. Each Service interoperates with other NPfIT Services by utilising 
mandated clinical coding and messaging standards with the common objective of providing patient data at 
the point of need. Each Service is built to satisfy a particular set of functional and non-functional demands 
to support a particular clinical usage. 


Each service is itself made up of a number of components, eg, application software, hardware, network 
and storage. It is inevitable that some of these components will fail, and, given the scale of the NHS, failures 
can be expected to occur frequently—a natural consequence of operating any large, complex, interconnected 
system. The idea is thus to implement a system that minimises the impact of failures—what is termed 
“resilience. This was recognised by the NPfIT from the beginning and the solution has therefore been 
architected and designed to be resilient to component failures. There are two fundamental architectural 
approaches that have been used to provide the required resilience: 


(1) The component systems are loosely coupled, that is to say a system should be able to continue 
operation even if it cannot access the other services (for example, should the central demographic 
service be unavailable, the hospital PAS will continue to operate). 


(2) The component systems are delivered without single points of failure, so, should a component fail, 
the system automatically fails over to “spare” (backup) components. 


The failover requirement is taken extremely seriously. As an example, the BT data centre has three 
generators and sufficient fuel to provide weeks of independent power, so, should there be a power failure to 
the site, the dedicated generators can be deployed to provide power. There are three generators so that 
should the site be running off their power and maintenance is needed on a generator; there is still a backup 
generator in case of failure. And of course BT has two geographically separated data centres both of which 
are equipped in this way should a catastrophic event happen at one of them. 


It is NHS Connecting for Health’s preference to host centrally as many services as is practical, because: 
— It is difficult to offer a resilient service on locally owned and deployed infrastructures. 


— Hosted services offer increased resilience options and controlled environments for backup and 
maintenance operations. 


— Hosted environments are easier to physically secure and keep up-to-date with the latest security 
countermeasures. 


— It is much more cost effective to deliver centrally hosted hardware resilience than equivalent 
resilience at multiple locations. 
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NHS Connecting for Health does not own all of the services deployed as part of the National 
Programme—so, for example, external organisations transmitting electronic prescriptions do so from their 
own networks, using their own infrastructure and using NPfIT accredited software of their choice. As such, 
there are many failure conditions outside of the direct control of the Programme. However, every service 
that can be deployed within the NPfIT goes through extensive clinical safety reviews and compliance testing 
before it can be connected and utilised as part of the NPfIT. 


_Those services that are procured directly by the NPfIT are typically operated by external suppliers in 
highly resilient data centre environments which offer industry-leading levels of resiliency and disaster 
recovery. This typically includes: 


— An Active/Active Primary Data Centre configuration and a secondary data centre that is either an 
active (Spine) or passive (London) replica of the Primary data centre: 

— There is Active/Active resilience built into the Primary Data Centres, and, should a disaster 
occur, the backup data centre is available to support the operations within the availability 
requirements for the System (currently 99.999% at the Spine, and 99.9% with improved 
performance objectives over time in London!’) 


— Interrupted connections will resume according to the agreed SLA. 


— Multiple network connections, so should one connection be lost, another is available 
automatically. 


— Hardware redundancy at all levels: 

— Protects against disk and hardware failure 

— Redundant processing power is available should a machine fail. 
— Zero data loss architectures : 


— Data is written simultaneously to the two Spine data centres, thus ensuring that no patient 
data is lost (there are effectively ten copies of each database across the two Spine data centres). 


— The Primary Data Centre at the London LSP shares a Storage Area Network (SAN) across 
the Active/Active configuration, and the SAN at the backup site is synchronously updated 
with the Primary Site. 


— End-to-end system monitoring against specific Service level agreements: 


— Automatic real-time alerting occurs in case services degrade or become unavailable for any 
reason. 


— Rigorous data security standards: 


— The System is designed, developed, tested and operated according to BS7799-2 Security 
Standards. 


— The Data Centres are secured physically at a level similar to Ministry of Defence systems 
(secure premises, guarded and badge access control, etc.) 


— Patient data confidentiality is protected via Role Based Access Control. 


— All authorised users are required to have Smart Cards issued by a central Registration 
Authority for Single Sign-on to the system via access rights granted through Spine Security 
Services. 


Availability, failover and recovery of each Service have been designed to match clinical need. 
Dependencies between Services have been clearly identified and consideration given to various failure 
scenarios. Guidance has thus been given to all suppliers regarding how to construct their applications to 
limit the impact should a failure occur. 


This decoupling approach is pervasive through all of the NPfIT and supplier-proposed solutions are 
evaluated against this as part of the NHS Connecting for Health assurance process. Such decoupling allows 
Services to continue to offer a range of capabilities regardless of whether a dependant service (eg, the 
National Summary Record) is available. The NPfIT end-to-end architecture supports the local queuing of 
messages for onward transmission to the failed service when it becomes available. 


NHS Connecting for Health services currently deployed have proven to be highly resilient in live service. 
But regardless of this, NHS Connecting for Health continues to work with suppliers and NHS Organisations 
to help maintain coordinated Business Continuity Plans in the event of a catastrophic failure. Each plan is 
tailored to which service could be affected and is highly specific to the clinical function it supports and the 
way it is integrated within a particular organisation’s business and technical infrastructure. 


All NHS Connecting for Health Services have been designed with high availability, and SLAs and 
performance statistics are made public. It is expected that the Trust Organisation will select and deploy any 
NPfIT services that are appropriate and update their Business Continuity Plan accordingly, based upon the 
Services they use and the clinical usage for which they are employed. 


17 99.9% availability equates to approximately 45 minutes of outage per month for the System. 
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Annex 2: Savings by Local NHS Organisations 





Acute Trusts 


University Hospital Birmingham 
Hospitals NHS Trust 


1. Cost of current level PAS: (over 


Mental Health Trusts 
Barnsley PCT 


1. Cost of System renewal with no 
additional functionality: (over 


Primary Care 
North Sheffield PCT 


1. Cost of GP Implementations: 


term) term) (£1.35m) Cost of operating existing (£130k) 
Operating cost (£30m) Operating cost contracts 
Implementation costs for new 0.7m Implementation cost for new £0.34m Implementation cost for new 36k 
system system system 
Net saving to Trust by transfer to _ (£29.3m) Net saving to Trust by transfer to (1.05m) Net saving to Trust of transfer to (£94k) 
CfH Solution CfH Solution CfH Solution 
Case 2. Cost of Trust Procurement: 2.Cost of System renewal with Bradford and Airedale PCT 
Studies (over term) additional functionality: (over (Bradford City, North Bradford, 
Cost of local purchase of more (£25m) term) (£2.9m) Bradford West) 
sophisticated PAS Operating Operating cost 
Costs 1.7m £0.34m 2. Estimated savings case study 
Implementation cost for new (250k) 
Net saving to Trust of CfH (£23.3) system (£2.6m) Annual savings 
solution Net saving to Trust of transfer to 
CfH Solution Net Savings to Trusts over term (£2.5m) 
Wirral Hospitals NHS Trust: 
3. Cost of NHS CRS Level 6 PAS SW Manchester Community PAS 
etc procured independently of Project: 
Programme (over term) 
Implementation Costs (based on (£27m) 3. Community PAS Projects: 
UHB Business Case) 
Net saving to Trust by transfer to Cost of operating existing 
CfH solution 1.0m contracts (Avg NHS stocktake) 
Implementation cost for new (£3.25m) 
(£26m) system 
Net saving to Trust of transferto (£0.962m) 
CfH Solution 
(£2.288m) 
West Yorkshire Community 
4. The Trust identified that it will 
cost £10k per practice to 
implement the NHS CRS 
solution. Savings to date have 
been in the region of £5k pa. The 
Trust will recover all 
implementation costs within two 
years of “Go Live”. 
National Net savings to NHS of (£4.008bn) Net cost of savings for Mental between |. Net savings to GPs (£399m) 
Equivalent implementing nationally procured Health Trusts of implementing (£108m) 2. Net savings for PCTs 
Value NHS CRS Acute solution with CfH procured solution and implementations (£189m) 
additional functionality (£232m) 3. Net saving for Community PAS 
(excludes local procurement costs) implementation (£138m) 





Annex 3: NHS use of identifiable and non-identifiable patient data for care and for secondary uses 


1. The oral evidence provided by certain witnesses to the Committee on the distinction between 


identifiable data and non-identifiable data, how these may be used and shared, and how they are protected 
in NHS Connecting for Health systems, was poorly informed and at times misleading. This note aims to 
provide clarification. 


2. Joint working between the Department of Health, the General Medical Council, the British Medical 
Association, the Information Commissioner and a range of patient groups, followed by extensive formal 
consultation, resulted in the publication of a confidentiality code of practice for the NHS in November 2003. 
This represented, for the first time, an agreed interpretation of how confidentiality law, and key aspects of 
Data Protection law, should apply in the NHS. 


3. Clinical patient information is confidential and classed as sensitive in the Data Protection Act 1998 
when it is held in a form that would enable the patient to be identified, as is the case with clinical records. 
The Data Protection Act regulates how this information is used, but does not prevent it being used for 
legitimate NHS purposes. Confidentiality law goes further and prevents information from being shared 
without consent except in exceptional circumstances (statutory provisions, court orders or significant public 
interest justification). 


4. The confidentiality code of practice clarified the circumstances where consent could be implied (opt- 
out) and those where a stronger evidentiary basis (opt-in) was required. Essentially implied consent was 
deemed appropriate for care purposes and work to assure the quality of care provided, but not for secondary 
uses of data, eg research and management. 


5. Patient contact, or demographic, details are subject to Data Protection Act provisions but are 
generally not confidential and so do not require consent for processing. Exceptions exist however and many 
people regard their address details as private, so it is Department of Health policy to safeguard contact 
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details to the extent that NHS business requirements permit. NHS Connecting for Health will also make 


available controls that prevent NHS staff from viewing these details when a patient requests that this be 
the case. 


6. The Courts'* have determined that when effective steps have been taken to prevent the individual from 
being identified, the information is no longer confidential and patient consent is no longer required. Where 
the process used to anonymise the information is reversible, the information, whilst exempt from consent 
requirements, may remain subject to the Data Protection Act provisions—this has not been tested in Court, 
but Department of Health policy is to accept that this is the case. Where it is irreversibly anonymised it is 
not subject to either consent requirements or the Data Protection Act. 


7. The NHS Connecting for Health Secondary Uses Service is being introduced to make anonymised and 
pseudonymised data available to appropriate users so that essential research and other work can be 
conducted without breaching confidentiality or privacy. Although information disclosed for secondary uses 
in a pseudonymised or anonymised form cannot identify individuals and doesn’t require consent 
management controls, it is still subject to a range of safeguards. 


8. There is considerable evidence however, that some purposes cannot be satisfied through use of 
anonymised information and that it may not be practicable to gain consent for these purposes either. In 
these cases, a statutory basis is required. A key statutory provision in respect of research and other secondary 
uses of patient data is Section 251 of the NHS Consolidation Act 2006 (previously known as Section 60 of 
the Health and Social Care Act 2001) which allows obligations of confidentiality to be set aside in limited 
circumstances under the supervision of the statutory Patient Information Advisory Group (PIAG). Key 
conditions for use of information under these provisions are that it must be impracticable to gain consent 
or to anonymise the information concerned. 


9. Professor Korff suggested in his evidence that PIAG is “quite easy about giving access” to data but it 
is evident that the research community would not support this view. In its January 2006 report on Personal 
data for public good: using health information in medical research the Academy of Medical Sciences stated 
that “Although admirable, this [PIAG’s] approach creates difficulties for research because PIAG has set a 
policy direction that appears to ratchet up existing legal standards. Rather than assess whether applications 
involve proportionate interference in privacy, PIAG applies a stricter standard of absolute and proven 
necessity.” 


10. The application of law, requirements for consent and the safeguards that are being developed and 
deployed for data held within the NHS Care Records Service and the Secondary Uses Service are set out in 
table 1. This illustrates the strong safeguards that are in place for all types of data. 


Table 1 (to Annex 3 





Non-clinical Personal clinical Personal clinical Pseudonymised Anonymised 
personal data data for care data for data for data for 
secondary uses secondary uses secondary 
uses 
Confidentiality law applies? Not generally Yes Yes No No 
Data Protection Act applies? Yes Yes Yes Yes—the legal No 


position is unclear 
but accepted as a 
matter of policy 


Patient consent required for creating a No No, but patients No N/A N/A 
record? given choice 

around the 

Summary Care 

Record asa 

matter of policy 
Patient consent required for sharing? No Yes Yes, unless there No No 

is a statutory 
basis 

Implied consent sufficient? N/A Yes No N/A N/A 
E-GIF level 3 registration of staff ? Yes Yes Yes Yes Yes 
E-GIF level 3 authentication of users via Yes Yes Yes Yes Yes 
smartcard? 
Audit Trail of user actions? Yes Yes Yes Yes Yes 
Audit Trail available to patients on request? No Yes No No No 
Role Based Access Controls? Yes Yes Yes Yes Yes 
Legitimate Relationship Access Controls? No Yes No No No 
Patient dissent to information sharing No Yes Yes Yes No 
recorded and acted upon? 
Sealed envelope prevents sharing of No Yes Yes Yes No 
identifiable data? 
Locked envelope prevents sharing of any No Yes N/A N/A N/A 
data? 
System alerts generated when users ene No YES N/A N/A N/A 
their own access rights eg to break a seal? 
Patient may request that contact details are Yes N/A N/A N/A N/A 
hidden from NHS staff? 


hidden fromm NFS St 
TTT 


18 R y Department of Health, ex parte Source Informatics (2000). 
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Annex 4: Reply to Parliamentary Question given on 21 June to Stephen O’Brien MP by the Department's then 
Minister of State, Caroline Flint 


21 Jun 2006 : Column 1946W 


Caroline Flint: A list of names of all the organisations and individuals that responded at one or other 
stage of the consultation process around the national specification for integrated care records service is not 
held centrally. Some of the responses were provided by organisations which are no longer active. 


The original “National Specification for Integrated Care Records Service (Consultation Draft)” was 
issued in July 2002 by the NHS Information Authority. Some 190 responses to the document were received 
from suppliers, clinicians, chief information officers (CIOs) information technology (IT) departments of 
national health service bodies and others, commenting on such aspects as architecture, functional omissions 
and the realisation of benefits that such a system would produce. These comments were included and formed 
the base document for the early draft of the output based specification (OBS). This draft was then refined. 
The clinical input was provided by almost three hundred individuals and the IT community (IT managers 
and CIOs) numbered a further one hundred. A broad spectrum of NHS stakeholders was then engaged to 
review the draft OBS. The review group encompassed leading clinicians, practitioners, policy advisors, 
health informaticians and managers and included representatives from the Department, the NHS 
Information Authority, strategic health authorities, NHS trusts, primary care trusts, general practitioners, 
academic groups and other Government Departments. 


It is known that many of these people also sought input from colleagues and we estimate that this cascade 
has resulted in many thousands of individuals having had a material input to the content and quality of 
the product. 


A final list of 239 people was invited to review the OBS, from which a total of 105 formal review 
documents were received. From the 900 pages reviewed there were 1,175 comments of substance. These 
comments resulted in a further refined version of the OBS which was then distributed for any final comment. 
A response to every individual comment was returned to the reviewer in question. 


Reflecting a level of transparency unprecedented for major projects within Government, the OBS was 
published to the public domain in July 2003 and is available on the Department’s website at www.dh.gov 
.uk/PublicationsAndStatistics/. 


In addition to many hundreds of internal meetings, there were 44 meetings held by the clinicians from the 
national programme with important stakeholders and stakeholder groups. These included several chairs of 
the Royal Colleges, and presentations to many hundreds of clinicians at various locations around the 
country. 


Data on those consulted on ways of managing the confidentiality of patient health information have been 
placed in the Library [see list below]. 


23 meetings were carried out as part of the research phase in addition to eight focus groups and 56 face- 
to-face interviews, involving patients, researchers, suppliers, senior care service managers, and NHS 
information governance professionals. 


Addenbrookes NHS Trust 

Age Concern 

Age Concern Harrow 

Association for Improvements in the Maternity Services (AIMS) 
Aintree Hospitals NHS Trust 

Airedale NHS Trust 

Airedale Primary Care Trust 

Alderney Hospital 

Alzheimer’s Society 

AMS Consulting 

Anite Public Sector 

Ashford & St Peters NHS Trust 

Association of Community Health Councils for England & Wales (ACHCEW) 
Association of Directors of Social Services (ADSS) 

Avon Gloucestershire & Wiltshire Health Authority 

Avon Information Management & Technology Consortium 
Avon/Wilts Mental Health 

Barnet Enfield & Haringey Mental Health Trust 

Barnsley Community Health Council 

Barnsley District General Hospital NHS Trust 
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Barts & the London NHS Trust 

Basildon & Thurrock General Hospitals NHS Trust 
Bebington and West Wirral Primary Care Trust 
Bed & Herts Local Medical Committee 
Birkenhead and Wallasey Primary Care Trust 
Birmingham Children’s Hospital 

Birmingham Heartlands Hospital 

Black Country Mental Health NHS Trust 
Blackpool Primary Care Trust 

Blackpool Victoria Hospital 

Bolton Asian Elders drop-in Centre 

Brain and Spine Foundation 

Brain Injury Rehabilitation Trust 

Braintree Care Trust 

Bridgend Local Health Group 

Brighton & Sussex University Hospitals 

British Heart Foundation 

British Medical Association (BMA) 

British Paediatric Surveillance Unit 

British Polio Fellowship 

Bro Morgannwg NHS Trust 

Bro Taf Health Authority 

Bromsgrove & Redditch Community Health Council 
Broomfield Hospital 

Buckinghamshire Mental Health NHS Trust 
Buckland Hospital 

Bucknall Hospital 

Budshead Health Centre 

BUPA 

BUPA Hospital Southampton 

Burnley, Pendle & Rossendale Community Health Council 
Burton Hospitals NHS Trust 

Bury & Knowle Health Centre 

Calderdale & Huddersfield NHS Trust 
Cambridge Community Health Council 
Cambridgeshire & Peterborough Mental Health Partnership NHS Trust 
Cambridgeshire Constabulary 

Cancer Bacup 

Canterbury & Thanet Community Health Council 
Carers UK 

Central Cornwall Primary Care Trust 

Central Derby Primary Care Trust 

Central Lancashire & Fylde Coast Hospital Information Systems 
Central Manchester and Manchester 

Children’s University Hospitals 

Central North West London Mental Health Trust 
Central Suffolk Primary Care Trust 

Centre for Health Services Studies (CHSS) 
Charlotte Keel Health Centre 

Charlton Lane Centre 

Chelford Surgery 
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Cheltenham General Hospital 

Cherwell Vale Primary Care Trust 

Cheshire Central Community Health Council 
Chichester Community Health Council 
Child & Family Service (Wellington) 

Child Health Centre 

Child Health Informatics Consortium 
Children’s Heart Foundation 

Chorley & South Ribble Primary Care Trust 
Christie Hospital NHS Trust 

Churches Together in England 

Citizens Advice Bureaux (CAB) 

City & Hackney Community Health Council 
City General Hospital 

Civica Services Ltd 

Clatterbridge Hospital 

Clinical Trials Service Unit 

Colchester General Hospital 

College for Health in London 

College of Health 

College of Occupational Therapists 

College of Optometrists 

Commission for Healthcare Audit and Inspection (CHAT) 
Communicable Disease Surveillance Centre 
Community Health Council Pensioners’ Forum 
Community Pharmacy 

Consumer Association 

Contact A Family 

Convent of Mercy 

Conwy Federation of Community Health Council’s 
Cornwall Information Services 

Countess of Chester Hospital NHS Trust 
County Durham Health Authority 

Courtesy Call Ltd 

Coventry & Warwickshire NHS Trust 
Coventry Community Council 

Coventry Primary Care Trust 

Crown House Surgery 

CSW 

Darlington Memorial Hospital 

Darlington Primary Care Trust 

Dental Practice Board 

Department of Health (DH) 

Derby City General Hospital 

Derbyshire Royal Infirmary 

Derriford Hospital 

Derwent Shared Services 

Dewsbury District Community Health Council 
Diabetes UK 

District Hospital (Roehampton) 

Diverse Minds 


Doncaster Central Primary Care Trust 
Doncaster Community Health Council 
Doncaster Royal Infirmary 

Dudley Beacon & Castle Primary Care Trust 
Dudley Group of Hospitals 

Dudley Social Services 

Dudley South Primary Care Trust 

Durham & Chester-le-street Primary Care Trust 
Durham Dales Primary Care Trust 

Dyfed & Powys Health Authority 

East Dorset Community Health Council 
East Hertfordshire Community Health Council 
East Kent Hospitals NHS Trust 

East Kent Primary Care Trust. 

East Staffs Primary Care Trust 

East Surrey Community Health Council 
East Sussex Hospitals NHS Trust 

East Yorkshire Community Health Council 
Eastern Cheshire Primary Care Trust 
Eastern Leicester Primary Care Trust 
Epilepsy Action 

Enigma Health UK Ltd 

Ethitec 

Fairfield Hospital 

Farnborough Hospital 

Federation of Irish Societies 

Fellowship of Depressives Anonymous 
Ferndown Primary Care Trust 

Fertilization and Embryo Authority 

Fleet Hospital 

Foundation of Information Policy Research(FIPR) 
Frimley Children’s Centre 

Frimley Park Hospital NHS Trust 

Front Street Surgery 

Gateshead Health 

General Medical Council 

George Eliot Hospital NHS Trust 

Glen Acre House CFS 

Gloucester Local Implementation Strategy 
Gloucester Partnership NHS Trust 
Gloucestershire Royal Hospital 

Goole Hospital 

Gosport Health Centre 

Grantham and District Hospital 

Graphnet 

Great Ormond Street Hospital for Children NHS Trust 
Great Western Hospital 

Green Lane Hospital 

Greenwich Community Health Council 
Gwent Community Health Council 
Hackney Social Services 


The Electronic Patient Record: Evidence Ev 181 





Ev 182 The Electronic Patient Record: Evidence 


Harefield NHS Trust 

Hampshire and Isle of Wight Strategic 
Health Authority 

Hampton Clinic 

Harrow Pensioners’ Forum 

Harrow Primary Care Trust 

Health Data Protection Ltd 

Health Service Ombudsman 

Healthy Islington 

Hearing Voices Network 

Heatherwood and Wexham Park Hospitals NHS Trust 
Help the Aged 

Hertford County Hospital 

Hertfordshire County Council 

Hicom Technology 

Hillingdon Hospital NHS Trust 
Hillingdon Primary Care Trust 

HM Prison Service 

Holy Family Presbytery 

Hospice care 

Hounslow Community Health Council 
Hull Community Health Council 
Humanity 

Humberstone Grange Clinic 

IBM 

IMECE Turkish Speaking Women’s Group 
IMS Health 

IMS MAXIMS 

Independent Complaints Advocacy Service 
Independent Healthcare Association 
Information Commissioner 

Institute for Quality Assurance 

Institute of Health Sciences 

Intellect (UK system supplier trade body) 
Interface Devices Ltd 

Ipswich Hospital NHS Trust 

Iranian Community Centre 

Island & Portsmouth Health ICT Service 
Isle of Wight Healthcare NHS Trust 
Islington Bangladeshi Association 
Islington Community Health Council 
Islington Health and Race Forum Group 
Islington Primary Care Trust 

Islington Zairean Refugee Group 

JADE Direct UK 

Jewish Care 

Jubilee Day Hospital 

Kennet and North Wiltshire Primary Care Trust 
Kent and Medway Hospital Information Systems 
Kent County Council 

Kettering General Hospital NHS Trust 
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Kidderminster Community Health Council 
King’s College Hospital 

Kingston Hospital NHS Trust 

Kirkham Health Centre 

Kokai Supplementary School 

Leeds Community Health Council 

Leeds General Infirmary 

Leeds North West Primary Care Trust 

Leeds Teaching Hospitals NHS Trust 

Leicester City West PCT—Child Health Services 
Leicester General Hospital 

Lincoln County Hospital 

Lincolnshire Shared Services 

Liverpool Central & Southern Community Health Council 
Liverpool Eastern Community Health Council 
Lloyds Pharmacy 

London School Hygiene and Tropical Medicine 
Macclesfield District General Hospital 
Macmillan Cancer Relief 

Manchester Mental Health and Social Care Trust 
Manchester NHS Agency 

Manchester Royal Infirmary 

Manor Gardens Advocacy Project 

Medical Defence Union 

Medical Protection Society 

Medical Research Council 

Medical Research Council Consumer Liaison Group 
Medway Maritime Hospital 

Mendip Primary Care Trust 

Mentis Management Consultants Ltd 

Mersey Care Trust 

Mid Downs Community Health Council 

Mid Surrey Community Health Council 

Mid Surrey Wheelchair Service 

Mid Yorkshire Hospitals 

Milton Keynes Community Health Council 
Moorfields Eye Hospital 

Moss Pharmacy 

Musgrove Hospital 

National Audit Governance 

National Care Standards Commission 

National Confidential Enquiry into Perioperative Deaths 
National Council of Women 

National Patient Safety Agency 

National Pharmaceutical Association 

National Programme for Information Technology (work stream leads) 
NDC health 

New Roots 

Newcastle General Hospital 

Newchurch Ltd 

Newhall Surgery 
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Nexor 

NHS Confederation 

NHS Information Authority 

NHS Litigation Authority 

Nightingale Macmillan Unit 

Health & Social Care Community of North & East Devon (previously N&E Devon Health Authority) 
North & Mid Hants Health Authority 

North East Yorkshire & North Lincolnshire Strategic Health Authority 
North Manchester General Hospital 

North Staffordshire Community Health Council 
North Staffordshire Hospital Information Systems 
North Staffordshire Hospital NHS Trust 

North Tees & Hartlepool NHS Trust 

North Tyneside Community Health Council 
North Warwickshire Primary Care Trust 

North West Lincolnshire Community Health Council 
North West London Hospitals NHS Trust 
North West London Strategic Health Authority 
Northallerton & District Community Health Council 
Northampton General Hospital NHS Trust 
Northern Cancer Network 

Northern General Hospital 

Northrop Grumman Missions Systems 

Norwich Primary Care Trust 

Nottingham Acute Hospitals Partnership 
Nottingham City Hospital NHS Trust 
Nottingham Health Informatics Service 
Nuffield Orthopaedic Centre NHS Trust 

Nurses of British Computer Society 

Oldwell Surgery 

Optx Ltd 

Orion Health 

Ottery St. Mary Hospital 

Our Lady’s Convent 

Oxford City Primary Care Trust 

Oxford Radcliffe Hospital 

Parkinsons Disease Society 

Partnership with Older People 

Patient Concern 

Patient Forum 

Patient Reference Group 

Patient Voice 

Patients’ Association 

Peapod consulting 

Peninsular Medical School 

Pennine Acute Hospitals NHS Trust 

Pennine Care NHS Trust 

Perinatal and Epidemiology, Oxford 

Per-Se Technologies 

Peterborough District Hospital 

Pilot Patient Project Lewisham 
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Plaistow Hospital 
Plymouth Primary Care Trust 
Pontypridd & Rhonda NHS Trust 
Poole Hospital NHS Trust 
Portman Clinic 
Portsmouth City Council Social Services 
Portsmouth City Primary Care Trust 
Prescription Pricing Authority (PPA) 
Prison Health Department (DH) 
Psychological Support Service 
Psynapse 
Public Health Laboratory Service 
Queen Elizabeth Hospital 
Queen Mary’s Hospital 
Queen Victoria Memorial Hospital 
Queens Hospital 
Queen’s Hospital (Burton upon Trent) 
Queen’s Park Hospital 
Queens Park Medical Centre 
Railway Medina Tavern 
Redbridge Assertive Outreach Team 
Rethink Mind 
Richmond & Twickenham Primary Care Trust 
Robert Jones/Agnes Hunt Orthopaedic and District Hospital NHS Trust 
Romsey Dental Care 
Rotherham District General Hospital 
Royal Albert Edward Infirmary 
Royal Alexandra Hospital 
Royal Berkshire Hospital 
Royal Bolton Hospital 
Royal Bournemouth Hospital 
Royal Brompton Hospital 
Royal College of Anaesthetists 
Royal College of General Practitioners 
Royal College of Paediatrics and Child Health 
Royal College of Physicians 
Royal College of Speech and Language Therapists 
Royal College of Surgeons of Edinburgh 
Royal College of Surgeons of England 
Royal Devon & Exeter Health Care NHS Trust 
Royal Free Hampstead NHS Trust 
Royal Gwent Hospital 
Royal Hallamshire Hospital 
Royal Leamington Spa Rehabilitation Hospital 
Royal London Hospital 
Royal Manchester Children’s hospital 
Royal National Institute for the Blind (RNID) 
Royal National Orthopaedic Hospital NHS Trust 
Royal Oldham Hospital 
Royal Pharmaceutical Society 
Royal Preston Hospital 
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Royal Surrey County Hospital NHS Trust 
Royal United Hospital 

Royal Victoria Infirmary 

Royal West Sussex NHS Trust 

Royston, Buntingford & Bishops Stortford Primary Care Trust 
Rusholme Health Centre 

Salford Royal Hospitals NHS Trust 

Salisbury Healthcare NHS Trust 

Salters Meadow Health Centre 

Sandwell Hospital 

Scarborough Hospital 

Schlumberger Sema 

Sedgefield Primary Care Trust 

Selby & York Primary Care Trust 

Selly Oak Hospital 

Sexually Transmitted Disease Clinic 

Sheffield South West Primary Care Trust 
Sheffield Teaching Hospital NHS Trust 

Sisters of St Joseph of Peave 

Social and Community Services 

Social Care Information Policy Unit 

Society & College of Radiographers 

Society of Chiropodists & Podiatrists 

Somerset Coast Primary Care Trust 

Somerset Local Medical Committee 

Somerset Partnership NHS and Social Care Trust 
Somerville Medical Centre 

South Birmingham Mental Health Trust 

South Brooks Community Health Council 
South Bucks Community Health Council 

South Devon Healthcare Trust 

South Downs Health NHS Trust 

South East Oxon Primary Care Trust 

South Staffordshire Healthcare 

South Tees Acute Hospitals 

South Tees Community Health Council 

South Tees Hospitals NHS Trust 

South Tyneside Community Health Council 
South Warwickshire Community Health Council 
South West Dorset Primary Care Trust 

South West Kent Primary Care Trust 

South West Surrey Community Health Council 
Southampton General Hospital 

Southend Community Health Council 

Southend Hospital NHS Trust 

Southend Patients’ Public Voice 

Southern Derbyshire Acute Hospitals NHS Trust 
Southern Derbyshire Community Health Council 
Southport & Formby Community Health Council 
Southport District General Hospital 

Southward Primary Care Trust 
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St Andrew’s Hospital 

St Bartholomew’s Hospita! 

St Catherine’s Hospital, 

St Dominic’s Priory 

St Francis Presbytery 

St Georges Hospital 

St Helens & Knowsley Community Health Council 
St Helens & Knowsley Hospitals Trust 

St Helier Hospital 

St James’ Hospital 

St James’ University Hospital 

St Joseph’s Church 

St Luke’s Hospice 

St Nicholas’ Hospice 

St Teresa’s Presbytery 

Stafford General Hospital 

Staffordshire Moorlands Primary Care Trust 
Staffordshire University 

Stockport NHS Trust 

Stockport Primary Care Trust 

Stoke Mandeville Hospital NHS Trust 
Suffolk Social Services 

Sunderland Community Health Council 
Sunderland Royal Hospital 

Sunderland Teaching Primary Care Trust 
Surrey Ambulance NHS Trust 

Surrey Oaklands NHS Trust 

Sutton & Merton Primary Care Trust 
SW Surrey Community Health Council 
Swindon & Marlborough NHS Trust 
Syntegra UK 

Tameside & Glossop Acute Trust 
Tameside & Glossop Primary Care Trust 
Target Four 

Taunton and Somerset Hospital 

Taunton Deane Primary Care Trust 
Teddington Memorial Hospital 

Tees and North East Yorkshire NHS Trust 
Telford & Wrekin Primary Care Trust 
The Audit Commission 

The British Polio Fellowship 

The Haemophilia Society 

The Health Centre 

The Hospice of St Francis 

The Medical Centre 

The Surgery 

The Walton Centre for Neurology & Neurosurgery 
Tolworth Hospital 

Torbay Hospital 

Torex 

Tower Hamlets Community Health Council 
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Trafford General Hospital 

Trent Cancer Registry 

Triple G 

Tunbridge Wells Community Health Council 
UK Carers Organisation 

UK National Screening Committee 

UK Newborn Screening programme Centre 
UK Transplant 

United Bristol Healthcare NHS Trust 
University College Hospital London 
University Hospital Aintree 

University Hospital of Hartlepool 
University Hospitals of Coventry & Warwickshire NHS Trust 
University Hospitals of Leicester 
University of Birmingham 

University of Central England 

University of Leeds—School of Healthcare 
University of Leicester 

University of Salford 

University of Sheffield 

University of Warwick 

Vale of Aylesbury Primary Care Trust 
Vega consulting 

Victim Support 

Voluntary Action Leeds 

Wakefield West Primary Care Trust 
Walsall Community Health Council 
Walsall Primary Care Trust 

Wandsworth Community Health Council 
Wandsworth Contact a Family 
Wandsworth Pilot Patients Forum 
Warrington Community Health Council 
Watch Tower (Jehovah’s Witnesses) 
Watercress Medical Centre 

Watford & Three Rivers Primary Care Trust 
Webstar Health 

Welsh Assembly Government 

Welsh Language Board 

Wessex Local Medical Committee’s 

West Cheshire Hospital 

West Hertfordshire Hospitals NHS Trust 
West Kent NHS & Social Care Trust 
West Lancashire Primary Care Trust 
West Lincolnshire Primary Care Trust 
West London Mental Health NHS Trust 
West Middlesex University Hospital 
West Midland Strategic Health Authority 
West Midlands Ambulance NHS Trust 
West Midlands Perinatal Institute 

West Suffolk Community Health Council 
West Suffolk Hospitals NHS Trust 
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West Surrey Health Community 

West Sussex Health and Social Care 

Weston Area Health Trust 

Weston General Hospital 

Wexham Park Hospital 

Whiston Health Centre 

Whiston Hospital 

Whittingdon Hospital NHS Trust 

William Brown Centre 

Winchester and Central Hampshire Community Health Council 
Winchester and Eastleigh NHS Trust 

Wirral NHS Trust 

Wolfson Institute of Preventive Medicine 
Wolverhampton City Council 

Worcestershire Mental Health Partnership NHS Trust 
Worthing and Southlands NHS Trust 

Wyre Forest Primary Care Trust 

York Hospital 


Annex 5: Patient safety benefits to be achieved from electronic patient records 


Key to understanding how the systems being developed by NHS Connecting for Health can play a part 
in reducing adverse events, particularly medication errors, is an appreciation of: 


— the scale of the problem, 

— the root causes of any avoidable errors, 

— the evidence supporting the role of IT in reducing some of the root causes, and 
— anexplanation of the new systems themselves. 


Scale of the Problem: 


There is evidence from international literature that medication errors occur in all health care settings, with 
some errors occurring repeatedly not just within one healthcare system, but across healthcare systems 
worldwide. Whilst the UK evidence base is not as strong as it is in other countries, particularly the United 
States, this does not mean that the NHS in England is immune from this problem. As such, the study by 
Charles Vincent ef a/ is particularly helpful in demonstrating the reality of this global phenomenon within 
the context of the health service in England. 

Whilst the authors do indeed state that “we can not extrapolate with any precision” it is nevertheless the 
authors themselves who do extrapolate the findings to the whole of the NHS with the conclusion: 

“Our findings strongly suggest that adverse events are a serious problem in the NHS, as they are 
in the United States and Australia. We estimate that around 5% of the 8.5 million patients admitted 
to hospitals in England and Wales each year experience preventable adverse events, leading to an 
additional three million bed days. The total cost to the NHS of these adverse events in extra beds 
days alone would be around £1billion a year”. 

Of course, this study only looks at adverse events occurring within hospitals. It is important not to 
overlook adverse events occurring outside the hospital setting. In this respect you may be interested in 
another UK based study which looked specifically into adverse drug reactions as a cause of hospital 
admission. This study, published in the British Medical Journal in 2004!’ concluded that: 

— One in 16 hospital admissions are the result of an adverse drug reaction (ADR)—72% of which 
are avoidable. 
— This equates to 4% of hospital bed capacity. 
At any one time the equivalent of 7 x 800 bed hospitals are occupied by patients admitted with 
ADRs. 
— ADRs causing hospital admissions are responsible for the death of 5,700 patients every year. 


— Cost to the NHS = £466 million. 
AGS deettcote ith 5 scsi ett es abated Bhs. ORDO oi Saree Eee. Si EN BR RR 


'9 Pirmohamed, M et al: Adverse drug reactions as a cause of admission to hospital: prospective analysis of 18,820 patients: BMJ 
2004; 329: 15-19. 
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Whilst neither of these studies is without its limitations, they nevertheless are extremely important in 
helping to quantifying the scale of the actual problem we face, and indeed are facing up to in England. 
Academic studies such as these do not become irrelevant just because they were conducted a number of years 
ago or because the situation may have improved since the study was conducted. Having acknowledged the 
scale of the problem, our focus now is on tackling the root causes of avoidable patient safety incidents rather 
than simply engaging in further studies to re-confirm that there is indeed a problem. 


Root Causes: 


Although patient safety incidents are diverse in nature, a study carried out by National Audit Office in 
2003-04 and reported in “A Safer Place for Patients”*® revealed that the most common patient safety 
incidents in hospitals after patient falls related to medication errors, record documentation error and 
communication failure. 


This is supported by the Audit Commission in their report “A Spoonful of Sugar’?! which made the 
following conclusions: 


— Complications arising from medicines treatment are the most common cause of adverse events in 
hospital patients. 


— Errors may occur from the initial decision to prescribe to the final administration of the medicine, 
and these include choice of the wrong medicine, dose, route, form, and frequency. 


— Most errors are caused by the prescriber not having immediate access to accurate information 
about either the medicine (its indications, contraindications, interactions, therapeutic dose, or side 
effects); or the patient (allergies, other medical conditions, or the latest laboratory results). 


— Hand-written prescriptions or patients’ notes also contribute to errors as they may be illegible, 
incomplete, subject to transcription errors or make use of inappropriate shorthand. 


— Prescription sheets themselves may also be temporarily unavailable or lost. 


Safe, effective clinical care also depends on reliable, error-free communication between different providers 
of care. Communication breakdowns between healthcare providers are a common feature in episodes of 
avoidable patient harm. This was highlighted in the Department of Health publication “Building a Safer 
NHS for Patients: Improving Medication Safety”: 


“Effective communications are critically important when patients move from one care setting to 
another; many medication errors occur at such ‘handover points’. Serious errors have occurred 
because of poor communication between primary and secondary care. Accurate information 
about current treatment is essential when patients are admitted to hospital to enable an accurate 
clinical assessment and to plan future treatment. And on discharge, the patient’s drug regimen and 
treatment plan need to be communicated in a timely and reliable way to ensure safe and seamless 
transfer of care back to the primary care team’””?. 


Information Technology & Patient Safety—The Evidence 


Research sources provide ample evidence that information technology can improve patient safety 
through eliminating many of the root causes described above. The enclosure to this Annex provides a 
summary of just some of the available evidence. NHS Connecting for Health has taken account of this 
research evidence in framing the scope of the Programme to ensure the delivery of better care and improved 
safety for patients. 


National Programme for IT in the NHS- Supporting Patient Safety 


The following is a brief explanation of how some of the elements of the overall NHS Care Record Service 
will contribute to reducing incidents of patient harm. In places this includes data obtained from the National 
Patient Safety Agency’s, National Reporting & Learning System (NRLS) to help highlight the potential 
patient safety benefits. However, it should be noted that whilst the reporting of patient safety incidents to 
the NRLS is becoming more established practice, and is now a core standard the NHS is expected to adhere 
to, the figures are still likely to underestimate the full scale of such patient safety incidents. 


0 A Safer Place for Patients: National Audit Office, HC 456 Session 2005-06. 
21 4 Spoonful of Sugar: medicine management in NHS hospitals: Audit Commission 2001. 
2 Building a Safer NHS for Patients: Improving Medication Safety—Department of Health 2004. 
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Personal Demographics Service 





Right Patient, Right Care: 


Use of the NHS number as the unique identifier in all healthcare interactions in England will, when fully 
achieved, make a major contribution to patient safety. 


Currently, an individual patient has different identifying numbers in different NHS organisations and 
sometimes even within the same NHS organisation. 


The dangers of this are well illustrated by information extracted from the NRLS which shows that 
between November 2003 and May 2006 there were 600 patient safety incidents reported which related 
directly to patients’ identifying numbers. Furthermore, the NRLS also reveals that between January 2006 
and December 2006 alone there were 7,984 patient safety incidents reported where the incident type was 
“Patient Incorrectly Identified”. 


In this respect, the Personal Demographic Service (PDS)—which allows authorised NHS health and 
social care practitioners accurately and efficiently to trace patients against the patient’s most up to date 
demographic details; thus identifying the patient’s unique NHS number will make a key contribution to 
patients’ safety benefits. 


PDS underpins all current and future NHS Connecting for Health products and, with approximately 50 
million demographic records for everyone in England stored on the database, it is already supporting the 
delivery of the Choose and Book Service (potentially benefiting over 45 million patients with in excess of 
17,500 bookings daily) and the Electronic Prescription Service (potentially benefiting about 15 million 
patients with in excess of 185,000 prescription messages daily). 


The PDS is of course central to realising the ultimate goal of delivering high quality and safe care across 
different health care organisations through the NHS Care Record Service. But even now, over 1.5 million 
patient records are successfully retrieved from the PDS every day, helping to correctly identify patients. 


NHS Summary Care Record: 


The Summary Care Record (SCR) forms the national element of the NHS Care Record Service and will 
provide authorised health care professionals with access to key clinical information about a patient 
anywhere, at any time. 


The record will grow over time but will go live from this year under the Early Adopter Programme before 
moving to full national roll out. In the initial stages, the record (subject to patient consent) will contain the 
following information held on the GPs record: 


— Known allergies 

— Known adverse reactions 

— Medications—acute prescriptions in past 6mths and repeat prescriptions in past 18mths 

— Significant diagnoses and problems (+ any other significant issues, treatments, operative 
procedures etc) 


This information was provided as part of the HSC oral evidence session on 26 April 2007. 


Future phases of the SCR will see it hooking up with the Electronic Prescription Service to provide a richer 
view of medications, and the Choose and Book service to provide referral information as well as capturing 
information from secondary care such as discharge information, outpatient letters and emergency care 


reports. 


The importance of having access to this basic patient information is highlighted by the following 
information obtained from the NRLS (England only) between January and December 2006: 


— 1,678 reported patient safety incidents where the patient was allergic to the treatment given. 

— 916 patient safety incidents where the patient suffered an adverse drug reaction (when the drug was 
used as intended). 

— 1,147 reported patient safety incidents where the treatment given was contraindicated in relation 
to drugs or conditions. 

— 821 patient safety incidents reported where the primary cause given for the incident was “missing / 

inadequate / illegible referral letter”. 

28,875 patient safety incidents reported relating to “documentation” eg missing / illegible / misfiled 

(See footnote for specific search filters)”* 


2 NRLS Search Filters = “Documentation- no access to” + “Documentation- missing / inadequate / illegible referral letter or 
healthcare record / card” + “Documentation- delay in obtaining healthcare record / card” + “Documentation- misfiled”. 


Ev 192 The Electronic Patient Record: Evidence 


Electronic Prescription Service (EPS): 


With around 1.3 million prescriptions now being issued every working day in England, and this figure 
expected to rise by 5% each year, the development of the EPS (which replaces a paper based system with an 
electronic one which is more efficient and consistently accurate) is absolutely critical to providing health care 
professionals with up to date and accurate information about the range of medications a patient might be 
taking at any point in time. 


In a study of older people at the University Hospital of North Durham, a structured review of patients’ 
medication was conducted after admission. An average of almost one drug per patient was found to be 
inappropriate and stopped and an average of approximately one drug per two patients was started following 
identification of omissions in the drug history.” 


The importance of having up to date medication information for older patients is further illustrated as 
follows”: 


— As people get older, their use of medication tends to increase. Four in five people over 75 take at 
least one prescribed medicine, with 36% taking four or more medicines. 


— Adverse reactions are implicated in 5%-17% of hospital admissions for older people. 
— While in hospital, 6%-17% of older inpatients experience adverse drug reactions. 


— Older people who are taking four or more medicines have increased risk of suffering an adverse 
reaction to a medicine and being readmitted to hospital as a result. 


The EPS has been designed to provide medication data to the NHS Care Record. The NHS Care Record, 
populated by data from the EPS will, over time, provide a single, authoritative point of reference for the 
medication a patient has been prescribed and dispensed and has the potential to lead to a significant 
reduction in medication errors caused by a lack of instantly available medication information. 


Already, over 4,825 pharmacies and 5,778 GP practices have EPS technology benefiting a potential 9.1 
million patients. To date, over 26.5 million prescription messages have been issued electronically, with the 
weekly count exceeding 900,0000. 


Details of the status of Pharmacy Systems Suppliers can be found on the NHS CFH web site at 
“http://www.connectingforhealth.nhs.uk/systemsandservices/eps/supplierstatus/ 
pharmacysystemsuppliers” 


E-Prescribing: 


Whereas the patient safety benefits of the Electronic Prescription Service lie principally in providing 
clinicians with up to date information about a patient’s medications through links to the NHS Care Record, 
the benefits of e-Prescribing systems lie in reducing actual prescribing errors and administration errors often 
associated with prescribing. 


A study® into the incidence of adverse drug events and potential adverse drug events reviewed 4,031 
patient records and found an incidence of 6.5% actual and 5.5% potential errors. Of these: 


— 56% related to errors at the ordering stage 
— 34% related to administrative errors 

— 6% were transcription errors 

— 4% were dispensing errors 


The Agency for Health Care Policy and Research (USA) published a research in action paper claiming 
that computerised medication order entry (also known as e-Prescribing systems) has the potential to prevent 
an estimated 84% of dose, frequency and route errors in prescribing. This report cites numerous other 
research studies, which claim safety benefits from computerised medication order entry systems or e- 
prescribing systems.’ 


NHS Connecting for Heath is providing the functional specification to be incorporated into the local 
detailed record solutions being developed by the Local Service Providers and will allow for: 


— Computerised entry and management of prescriptions. 


— Decision support, aiding the choice of medicine and other therapies, with alerts covering, for 
example, drug interactions, contra-indications, allergic reactions and other safety-related issues. 


— Knowledge support, giving users immediate access to up-to-date drug information such as the 
British National Formulary. 


4 Building a Safer NHS for Patients: Improving Medication Safety—Department of Health 2004. 

54 Spoonful of Sugar: medicine management in NHS hospitals: Audit Commission 2001. 

6 Bates DW, Cullen DJ, Laird N, Petersen LA, Small SD, Servi D, et al. Incidence of adverse drug events and potential adverse 
drug events. JAMA 1995; 274: 29-34. 

77 Reducing and Preventing Adverse Drug Events to Decrease Hospital Costs. Research in Action, Issuel AHRQ Publication 


Number 01-0020 March 2001. Agency for Healthcare Research and Quality, Rockville .MD. http://www.ahrq.gov/qual/ 
aderia/aderia.htm 
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— Electronic links between hospital wards/departments and pharmacies. 
— Arobust audit trail for the entire medicines provision process. 


_E-Prescribing systems will be underpinned by the Dictionary of Medicines and Devices (dm+d), a 
dictionary containing agreed unique identifiers and associated textual descriptions for medicines and 
medical devices. The dm + d will help make e-Prescribing systems interoperable with other NHS IT systems, 
enabling safe and reliable exchanges of information on medicines and devices and effective decision support 
through linkages of data. 


Of course, others of the many products and initiatives being developed and deployed by NHS Connecting 
for Health will also contribute to improving patient safety. 


Enclosure to Annex 5 


Supporting Evidence 
Bates and Gawande 2003. The conclusions of the work by Bates, et a/. reports the following benefits: 


— Information technology can substantially improve the safety of medical care by structuring 
actions, catching errors, and bringing evidence-based, patient-centred decision support to the 
point of care to allow necessary customisation. 


— The use of decision support for clinical decisions can also result in major reductions in the rate 
of complications associated with antibiotics, and can decrease costs and the rate of nosocomial 
infections. 


— 53%-83% reduction in serious medication errors. 


Bates, D W and Gawande, A A, /mproving Safety with Information Technology. New England Journal of 
Medicine 2003, 348:2526-34 
(http://content.nejm.org/cgi/content/short/348/25/2526) 


The Agency for Health Care Policy and Research (USA) published a research in action paper claiming 
that computerised medication order entry has the potential to prevent an estimated 84% of dose, frequency 
and route errors. This report cites numerous other research studies, which claim safety benefits from 
computerised medication order entry systems. 


Reducing and Preventing Adverse Drug Events to Decrease Hospital Costs. Research in Action, Issuel 
AHRQ Publication Number 01-0020 March 2001. Agency for Healthcare Research and Quality, Rockville 
.MD. 
http://www.ahrq.gov/qual/aderia/aderia.htm 

The LEAPFROG Group for patient safety Rewarding Higher Standards (USA) quotes the following 
examples of safety benefits from physician order entry systems: 

(i) A study by David Bates, MD, Chief of General Medicine at Boston’s Brigham and Women’s 
Hospital, demonstrated that their Computer Physician Order Entry (CPOE) system reduced error 
rates by 55% from 10.7 to 4.9 per 1,000 patient days. 


Bates DW, Leape LL, Cullen DJ, Laird N, et al. Effect of computerized physician order entry and team 
intervention on prevention of serious medication errors JAMA. 1998;280:1311-6. 

(ii) Rates of serious medication errors fell by 86% in a subsequent study by the same group. The 
prevention of errors was attributed to the CPOE system’s structured orders and medication 
checks. 

Bates DW, Teich JM Lee J Seger D, Kuperman GJ, Ma’Luf N, Boyle D, Leape L The impact of 
computerized physician order entry on medication error prevention JAMIA. 1999;6:313-21 

(iii) John Birkmeyer, MD, a surgeon and health services researcher at Dartmouth Medical School, 
estimates that implementation of CPOE systems at all non-rural US hospitals could prevent over 
500,000 serious medication errors each year. 


Birkmeyer JD, Birkmeyer CM, Wennberg DE, Young MP. Leapfrog safety standards: potential benefits 
of universal adoption. The Laepfrog Group. Washington DC: 2000 


E-prescribing report prepared by First Consulting Group for California Healthcare Foundation claims 
patient safety benefits from e-prescribing and references a Movement championed by the Institute for Safe 
Medication Practices, calling for the universal adoption of e-prescribing and the abandonment of hand 
written prescriptions by 2004, for the improvement of prescribing safety. 


Kilbridge Peter, MDE & Gladysheva Katy, First Consulting Group, E-Prescribing prepared for 
California Healthcare Foundation 2001. 


A report on the prevention of medical errors by First Consulting asserts that it is through understanding 
and altering the processes by which complex systems operate that quality is best achieved and improved. 
Healthcare quality requires, perhaps more than anything does, access to reliable information at the point 
of medical decision-making. As such, the provision of clinical care is an information-dependent process. 
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Two principal kinds of information management support care quality. The first is collection of and access 
to real-time clinical data at the point of care. What did this patient’s X-ray reveal? What medications is she 
receiving? Access to point-of-care information assists the clinician in treating the patient “here and now.” 
A second kind of information is aggregate data on populations of patients. This data can be retrospectively 
examined to identify practice patterns, incidence of disease or complications, and the like. It can also be used 
to target specific practitioner behaviours for improvement. 


Both types of information management are required as part of any coherent strategy to measure and 
improve the quality of healthcare delivered. Implementing evidence-based medicine in a healthcare delivery 
organization requires a substantial investment in rethinking and fine-tuning clinical processes across the 
continuum of care. Moreover, creating more reliable and effective clinical processes and practices 
necessitates introducing information technology into the hands of physicians and other caregivers. 


Classen D and Kilbridge P—Health quality and the prevention of medical errors, First Consulting Group 
June 2000. 


Smart tags and packaging are already saving lives, preventing illnesses and sharply reducing costs in 
healthcare. The Protti World Review Report 14 cites examples of radio frequency identification technology 
and its benefits in healthcare. 


Radio-frequency identification: Its potential in Healthcare. Health Devices 34(5), May 2005:149-60 (no 
Authors listed) 
(http://www.connectingforhealth.nhs.uk/worldview?searchterm = Protti) 


Right patient, right blood new advice for safer transfusions—NHS Connecting for Health has supported 
the National Patient Safety Agency in the development of new measures to improve the safety of blood 
transfusions, including photo ID cards and electronic tracking systems for patients and blood. 
(http://www.npsa.nhs.uk/display?contentld = 5354) 


Protti World View Report 8 is the first of two reports providing an overview of clinical information 
technologies that are helping to save lives and improve the quality of life for patients. This report includes 
references to the benefits of Picture Archiving and Communications Systems (PACS) such as improved 
speed and accuracy of diagnosis. 

(http://www.connectingforhealth.nhs.uk/worldview?searchterm = Protti) 


Protti World View Report 3 shows how the value of computers in healthcare can be about improving 
decision-making. This report includes references to the benefits of computerised electronic patient record 
systems. It suggests that electronic systems enable physicians and nurses to make better, quicker decisions 
with the aid of on-line access to evidence-based results, assistance in placing orders, detecting drug 
interactions, and receiving alerts after abnormal test results. This delivers more efficiency with fewer errors. 
(http://www.connectingforhealth.nhs.uk/worldview?searchterm = Protti) 


Protti World View Report 2 specifically focuses on how the use of computers in healthcare can reduce 
errors, improve patient safety and enhance the quality of care. Incomplete information in records and the 
difficulty that clinicians have in keeping up with the rapidly growing clinical evidence base are significant 
problems that can be mediated by IT. The US Institute of Medicine—Quality Chasm report 2001 is quoted 
“The current care systems cannot do the job. Trying harder will not work. If we want safer, higher-quality 
care, we will need to have redesigned systems of care, including the use of IT to support clinical and 
administrative processes. 

(http://www.connectingforhealth.nhs.uk/worldview?searchterm = Protti) 


The Audit Commission report “a spoonful of sugar—medicines management in NHS hospitals—2001” 
reported that: 


— Electronic prescribing reduces medicine errors significantly by providing timely, legible 
information. One study concluded that improved information systems could contribute to the 
prevention of 78% of transcription errors leading to adverse medicine events. 


— Computerised systems containing rules to prevent incorrect or inappropriate prescribing have also 
reduced the incidence of errors and increased the appropriateness of medicine treatment. 


— Computerised prescribing linked with electronic health records will radically alter the way in which 
care is provided and will deliver significant improvements in the quality of patient care (Ref. 86). 
The introduction of these systems, which ultimately need to be accessible by primary care and 
other hospitals, is vital to provide access to common clinical data. It is one of the biggest challenges 
currently facing the NHS. 


(http://www.audit-commission.gov.uk/Products/NATIONAL-REPORT/E83C8921-6CEA-4b2c-83E7- 
F80954A80F85/nrspoonfulsugar.pdf) 
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Annex 6: NHS existing systems suppliers that have obtained work under the National Programme 


Existing Systems Compliance Programme (Technical Authority to Deploy at 13 June 2007). 


ESP Programme 
Patient Administration Systems 

C&Bvl—McKesson Totalcare 
C&Bvl—iSOFT Clinicom 
C&Bv1—Harrogate (Silverlink/Anglia) 
C&Bvl—Capula Elan Oasis 
C&Bvl1—iSOFT iEXPRESS 
C&Bv1—Silverlink ICS 
C&Bvl—IMS Maxims BLKHEARTS 
C&Bvl—York Trust ICE/In house PAS 
C&Bv1—Ascribe (HEIS) eCamis 
C&Bvl—iSOFT IPM 
C&Bv2—Cerner Millennium 
C&Bvl1—IMS Maxims Hammersmith 
C&Bv2—EDS SWIFT 
C&Bv2—iSOFT iiEXPRESS 
C&Bv2—ATOS Origin SemaHelix 
C&Bv2—System C Medway 
C&Bv2—Royal Marsden Anglia/In house 
C&Bv2—iSOFT Clinicom 
C&Bv2 prov—Ascribe EPEX 
C&Bv2—Silverlink ICS 
C&Bv2—Royal Devon&Exeter SWIFT 
C&Bv2—iSOFT IPM 
C&Bv2—MckKesson Totalcare 
C&Bv2—Filetek Magic 
C&Bv2—McKesson Star 
C&Bv1—Misys CPR 
C&Bv2—UCLH (GE Healthcare) 
C&Bv2—IMS Maxims PAS/CAB 
C&Bv2—Norfolk & Norwich 
C&Bv2—Ultragenda 


Community Pharmacy Systems 
ETPv1I—AAH 
ETPv1—Hadley Healthcare Eclipse (Local/FDB) 
ETPv1—Cegedim Pharmacy Manager 
ETPv1—Enigma Nexphase 
ETPv1 -System Sol QicScript 
ETPv1—Lloyds PMR 
ETPv1—Positive Solutions PSL ETP 
ETPv1—Pharmacy Plus 
ETPv1—Enigma Mediphase 
ETPv1—RX System Proscript 
ETPv1—Boots Smartscript EPS 
ETPv1—Hadley Healthcare Eclipse (Local/HHPD) 
ETPv1—Cegedim Central Message Broker 
ETPv1—Lloyds Compass 
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General Practice Systems 


C&Bv1—Seetec GP Ent 

C&Bv1—InPS Vision 

ETPv1—The Phoenix Partnership SystmOne 
ETPv1—InPS Vision 

C&Bv1—The Phoenix Partnership SystmOne 
ETPvl—Seetec GP Ent 

C&Bvl1—EMIS LV 
C&Bv1—Microtest—Evolution Practice Manager 
GP2GPv1.0-EMIS LV 

C&Bv1—iSOFT Synergy 

C&Bv1—iSOFT Premiere 

ETPv1—EMIS LV 

ETPv1—EMIS PCS 

ETPvl—iSOFT Synergy 

ETPv1—iSOFT Premiere 
ETPv1l—Microtest Practice Manager 
C&Bvl|—EMIS PCS 

GP2GPv1.0-InPS Vision 

GP2GPv1.1-InPS Vision 

C&Bv2—Seetec GP Ent 

C&Bv2—iSOFT Synergy 

C&Bv2—iSOFT Premiere 
GP2GPv1.1-EMIS LV 

ETPvl1—EMIS PCS 


Independent Sector Treatment Centre 


C&Bv1—Cambio Cosmic 
C&Bv2—iQ System Serv iQUTopia 
C&Bv2—Streets Heaver Compucare 
C&Bv2—Cambio Cosmic 


QMAS & RFA (Level 0 GPSoC) 


QMAS v7—Microtest 

QMAS v7—In Practice 

QMAS v7—EMIS GV 

QMAS v7—EMIS PCS 

QMAS v7—EMIS LV 

QMAS v7—Ascribe Protechnic Exeter 
QMAS v7—iSOFT 

QMAS v7—The Computer Room 
QMAS v7—Seetec 

QMAS v7—The Phoenix Partnership 
QMAS v7—Healthy Systems 

QMAS v8.5 (R10)—Microtest 

QMAS v8.5 (R10)—EMIS LV 

QMAS v8.5 (R10)—EMIS GV 
QMAS v8.5 (R10)—EMIS PCS 
QMAS v8.5 (R10)—The Phoenix Partnership 
QMAS v8.5 (R10)—Healthy Systems 
QMAS v8.5 (R10)—InPS Vision 4 
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et 
QMAS v8.5 (R10)—iSOFT 
QMAS v8.5 (R10)—In Practice 
QMAS V8.5 (R10)—Ascribe Protechnic Exeter 
QMAS v8.5 (R10)—Seetec 
QMAS v8.5 (R10)—iSOFT Synergy Enterprise 
QMAS v9—iSOFT 
QMAS v9—Microtest 
QMAS v9—EMIS LV 
QMAS v9—Ascribe Protechnic Exeter 
QMAS v9—EMIS GV 
QMAS v9—EMIS PCS 
QMAS v9—In Practice 
QMAS v9—The Phoenix Partnership 
QMAS v9—Healthy Systems 
QMAS v9—Seetec 


Secondary User Service 


SUS—Indigo4 
SUS—Ardentia 


SUS—luvo 
SUS—NHSIA Exeter 
SUS—Anglia 


SUS—McKesson 
SUS—NHSIA Exeter 


Summary Care Record 


SCRvl 


Annex 7: LSPs provided the following examples of their experience in delivering systems and services as those 
required under the National Programme 


Fujitsu: Usha Mullapudi Cardiac Centre (UMCC), Hyderabad 


Implementation of a Hospital Management System to a 150-bed cardiac hospital equipped with four 
operating theatres, three catheterisation labs, a blood bank, a modern pathology lab, a spiral CT scanner 
and a pharmacy unit. 


The EPR maintained the overall patient medical history including past and present clinical findings, 
treatment details, medication details and progress notes. In-patient EPRs contained chart monitoring, test 
results, ward movement, discharge summary and visit details. The workflows generated by patient activities 
were mapped to modules for different hospital departments and functions: Reception; Wards; Billing; 
Pharmacy; Laboratory; Operation Theatre; Blood Bank; Electronic Patient Records; Financial; 
Accounting and Payroll; Stores; Duty Roster; Security and Administration; House Keeping and Laundry; 
Diet and Kitchen; Equipment Interface; Fixed Assets and Pathology Lab. 


Fujitsu: The Southern Derbyshire Acute Hospitals NHS Trust 


Development of a Trust Workforce Plan making effective use of information technology, suitable for 
internal and external purposes, to be integrated with service and financial planning and able to 


accommodate future changes. 

The Trust has a total of 1,147 beds across 44 wards and serves a population of over half a million people 
through Southern Derbyshire. The Trust employs approximately 5,500 staff from medical and nursing staff 
to ancillary staff within an annual budget of around £200 million. 
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Accenture: Andalusian Heath Care Service, Spain 


Design, build and run of a System and Technology Management centre serving the region and the 
management of the infrastructure to support “smart card” based electronic patient records as part of an 
ambitious modernization programme. The Andalusian Healthcare service is the largest public healthcare 
service in Spain with 75,000 employees including 14,000 physicians serving 7.3 million citizens. It has a 
complex health network made of 32 hospitals, 1300 primary health centres and over 100 specialized 
health centres. 


In November 1997 Accenture won a public offering to carry out the project, which consisted of building 
an Information Technology Management Centre in six months. This centre would assume the management 
of the health centres environment for the next three years, starting as of July Ist 1998. 


Accenture: The Milwaukee County Medical Centre 


The Milwaukee County Medical Centre is a 450-bed acute care hospital with a Level 1 trauma centre for 
the region. Its integrated delivery system includes 30 outpatient clinics, an eye institute and links to the 
Medical College of Wisconsin, Curative Rehab Hospital and Milwaukee County Behavioural Health 
Facility, a 600-bed psych, alcohol and drug treatment facility. 


Accenture served as the total outsourcing provider (all IT functions, including computer operations, 
technical services, help desk, WAN / LAN, desktop support and applications support, and all strategic 
planning, budgeting, etc.) since 1991. In 1996, the County sold the acute care facility. From 1996 to present, 
Accenture has provided Applications Management services to the remaining County-owned facility, 
Behavioural Health. 


CSC: 40 Danish Counties 


CSC Scandihealth is the largest supplier of healthcare IT software and services in Denmark and 
Scandinavia and the leading provider of electronic patient records systems to Danish hospitals. 


CSC: St Vincent's Catholic Medical Center, New York 


The St. Vincent’s Catholic Medical Centers (SVCMC) comprises seven facilities including acute centres 
and ambulatory clinics. In 2001, CSC has been awarded two contracts within the health system. The first 
outsourcing contract calls for supplying all aspects of the IT management for the duration of five years; the 
second, calls for creation of an integrated software and hardware platform for the Patient Management, 
Patient Accounting, Hospital Procurement and Accounting functions. 


CSC: Children’s Hospital Los Angeles (CHLA) 


Management of business and clinical information systems, including mainframe and midrange 
computers, desktop computers, helpdesk operations, voice and data communications, and applications 
maintenance and development. 


BT: NHS Information Authority, NHSNet Broadband Upgrade 


BT is delivering 256K bps NHS Net upgrades to 6,536 GP surgeries. 
BT is delivering 2Mbps NHS Net upgrades to 223 Hospitals. 
BT is providing the intensive programme management to upgrade 30 GP sites per day. 


The upgrade process takes 40 days, therefore BT is concurrently managing delivery to 1,200 sites at any 
one time. 


Contract value is in the region of £168 million, with rollout having commenced in December 2002. BT is 
currently rolling out 600 sites per month, and committed to complete by March 2004. 


BT: Salford & Trafford Health Authority 


This health authority serves around one million patients. It includes 113 GP practices, two major hospitals 
and a community NHS trust. 


BT partnered with the customer to assess current levels of equipment at its 113 sites and then developed 
an appropriate and cost-effective solution, which would meet the individual needs of the GP Primary 
Care Groups. 


BT implemented reliable electronic communication between all GP practices through a standard 
communications network. 
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BT delivered, trained and supported 250 desktop PCs (and 84 network connected printers, with access to 
BT managed email services and web browsing of the NHSnet and Internet, for users at GP practices. 


BT ensured that all existing GP System software (from the 3 clinical application suppliers) could be used 
on the desktop PCs. 


BT provides end-to-end service ownership, helpdesk and Service Level Guarantees for the end-to-end 
service. 


BT remotely accesses PCs to ensure maximum availability, optimum problem fix time and software 
downloads. 


BT: Walsall Trust 


Walsall Hospitals NHS Trust is responsible for the Manor Hospital—a 600-bed full acute hospital with 
A&E, maternity, dermatology, oncology, ete—and the nearby 120-bed non-surgical Goscote Hospital 


BT was prime contractor for the delivery of the Clinical Image Management Service 2000-01. The initial 
scope was for PACS storage for new CR in A&E Imaging. This included diagnostic and referential 
workstations for the Imaging and A&E Department, with potential to have web referential views across the 
extended campus. 


CSC: Scandihealth 


CSC’s EMEA public sector business was initially focused in the Nordic region, where CSC acquired 
Datacentralen, a state-owned IT service firm, and Scandinavian Healthcare Informatics. 


The Scandihealth business (with 300 professionals provides healthcare solutions to 70% of hospital beds 
in Denmark) was the starting point of CSC growth in healthcare in Europe. Nowadays the portfolio includes 
the full range of system integration, application development, consulting and operations management 
services, as well as vertical specific solutions, such as hospital information systems, laboratory systems and 
home care systems based on various partner platforms; for instance Oracle HTB is the key development and 
integration platform used in Denmark and CSC intends to leverage it in other countries too (eg Norway, 
Sweden, and Italy). 


National Switch Point (LSP) for the Dutch healthcare sector 


The National Switching Point enables healthcare players throughout the country to exchange patient 
information in a fast and safe way. With this initiative, CSC has built the foundations for the countrywide 
roll-out of a reliable Electronic Patient Record. 


The LSP is at the heart of the National Information Infrastructure (called Aorta) for the healthcare sector 
and enables parties in the sector to exchange patient information safely and quickly. This ‘mission critical 
control’ handles the access to patient information. Through the LSP, healthcare providers can ask for up- 
to-date patient information from systems of other hospitals, pharmacies and general practitioners. 


CSC’s Healthcare Experience outside the NHS NPfIT contract 


The Department of Health’s aim is to improve the health and wellbeing of the people of England. Its work 
includes setting national standards and shaping the direction of the NHS and social care services, and 
promoting healthier living. Health and social care services are delivered through the NHS, local authorities, 
arm’s length bodies and other public and private sector organisations. 


In 2002 CSC was awarded a seven-year IT outsourcing contract. The contract has since been extended 
for a further two2 years, the agreement will now run until 2011 and now includes an innovative new 
Managed Print Service. CSC’s service to DH comprises provision of a full infrastructure outsource, a 
number of areas of application support and development, as well as targeted consultancy provision. 


CSC and the Department have created an IT partnership which will support and enhance the Department 
of Health’s information and communications investments. Since the beginning of the relationship CSC has 
been involved in many projects to deliver new and improved services to the Department of Health, examples 
range from technology refresh programmes, to provision of flexible hosting services and innovative 


managed service solutions. 
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